Static task
static1
Behavioral task
behavioral1
Sample
4e46f001f5ed94730cf0104bfbf70968fe745bb49be512910cde1e740c887ad2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4e46f001f5ed94730cf0104bfbf70968fe745bb49be512910cde1e740c887ad2.exe
Resource
win10v2004-20230703-en
General
-
Target
4e46f001f5ed94730cf0104bfbf70968fe745bb49be512910cde1e740c887ad2
-
Size
1.2MB
-
MD5
cf4ef4514d8e67c0fe51de8dfdffeced
-
SHA1
0fb41ef50c5ed05943076c57385bdbe8b87057b6
-
SHA256
4e46f001f5ed94730cf0104bfbf70968fe745bb49be512910cde1e740c887ad2
-
SHA512
acb45ca076fad4d97e08d067db5c8c3dd62f075877d0a82a520f66eda5a08a1f301da01b32cf5c57c7bb122bd74c3bcbab66658ef833588be5d9c7fe9acc985c
-
SSDEEP
24576:o3/Nuw4Swhj6oUyf2mP05qrDEMTPJFTHhzPZVYRVMNJ7BkqxYEllVfLNinKfKxlE:E4wVwhsmP0crgMTPJzPZVYRVMNJ7Bkq4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e46f001f5ed94730cf0104bfbf70968fe745bb49be512910cde1e740c887ad2
Files
-
4e46f001f5ed94730cf0104bfbf70968fe745bb49be512910cde1e740c887ad2.exe windows x64
a0a34dcb81845ce820ea8723ce8e3441
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
DeleteFileW
HeapReAlloc
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetConsoleWindow
HeapSize
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetStringTypeW
SetStdHandle
InitializeCriticalSectionEx
CreateMutexW
AllocConsole
HeapFree
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
CloseHandle
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
IsDebuggerPresent
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
user32
CreateWindowExW
DefWindowProcW
ShowWindow
RegisterClassW
LoadIconW
MessageBoxW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
Sections
.text Size: 959KB - Virtual size: 958KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ