Static task
static1
Behavioral task
behavioral1
Sample
efc589b190ad8f5474778292db6181205b7c8e92a157887dbc011ad446be71fb.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
efc589b190ad8f5474778292db6181205b7c8e92a157887dbc011ad446be71fb.exe
Resource
win10v2004-20230703-en
General
-
Target
efc589b190ad8f5474778292db6181205b7c8e92a157887dbc011ad446be71fb
-
Size
1.7MB
-
MD5
3441d172138f883e233a88992a173a53
-
SHA1
f85016210193e526cd3d6d591facf7cf7341de28
-
SHA256
efc589b190ad8f5474778292db6181205b7c8e92a157887dbc011ad446be71fb
-
SHA512
efbdd4db9e67449b1e6a4d9aa7ad40742df3878e1646a08759faee58fbd631ff7d5890105c7d87c46a1c4b108d468659d2d33aec5b4f349d8a6364f08dfe803a
-
SSDEEP
24576:TgTvzF2+ZR52FqnpKRL+f8TtCr64K+CzzqHioatiDbNaNDyb3E4Slr/RO7qJc:T8r0+ZUh+fTK+Cz2HioatgbeDyQ5rp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efc589b190ad8f5474778292db6181205b7c8e92a157887dbc011ad446be71fb
Files
-
efc589b190ad8f5474778292db6181205b7c8e92a157887dbc011ad446be71fb.exe windows x64
159e926fcbaec5660cfcf1259c234341
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHDeleteKeyW
kernel32
TlsAlloc
WriteConsoleW
GetCurrentDirectoryW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
GlobalMemoryStatusEx
GetLocalTime
CreateMemoryResourceNotification
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageA
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
CreateFileW
WriteFile
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
ResetEvent
ReleaseMutex
SetWaitableTimer
CreateWaitableTimerW
GetExitCodeProcess
ResumeThread
CreateProcessW
GetProcessId
OpenProcess
FormatMessageW
ExpandEnvironmentStringsW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenMutexW
FileTimeToLocalFileTime
GetProcessTimes
GetSystemTime
MultiByteToWideChar
GetCurrentThread
GetComputerNameW
GetSystemDirectoryW
GetModuleHandleW
GetSystemInfo
GetStdHandle
DebugBreak
RtlUnwind
TlsGetValue
TlsSetValue
DeviceIoControl
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetExitCodeThread
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
GetConsoleOutputCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
RtlPcToFileHeader
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
Sections
.text Size: 782KB - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE