Static task
static1
Behavioral task
behavioral1
Sample
3ea99483166a09cfd00453efbd232c0013743ad05a3bcf93d7acb62e8c93acca.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3ea99483166a09cfd00453efbd232c0013743ad05a3bcf93d7acb62e8c93acca.exe
Resource
win10v2004-20230703-en
General
-
Target
3ea99483166a09cfd00453efbd232c0013743ad05a3bcf93d7acb62e8c93acca
-
Size
1.5MB
-
MD5
11adea449968d06301c435dc434e9971
-
SHA1
d7de38e79dccd0643afe5d5d731f749562f9946f
-
SHA256
3ea99483166a09cfd00453efbd232c0013743ad05a3bcf93d7acb62e8c93acca
-
SHA512
4b82ce2241c004984bdedb6639ccbb6b46850bfe7d44f019041c0a99ecc0d6b863337921aee266f55a85ebe8e4a1d5f49ea12447706bda52e98505d0b75b718d
-
SSDEEP
24576:vhoQh2Q3/AyplRlEiq4PacnsFXonYylzH17zOBtiDbNaNDyb3E4Slr/RO7qJc:aQHfvbPacnsFIjlzHtzOBtgbeDyQ5rp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ea99483166a09cfd00453efbd232c0013743ad05a3bcf93d7acb62e8c93acca
Files
-
3ea99483166a09cfd00453efbd232c0013743ad05a3bcf93d7acb62e8c93acca.exe windows x86
ad4614715ad66db51537a37035d11214
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteKeyW
kernel32
GetStdHandle
WriteConsoleW
GetCurrentDirectoryW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
GlobalMemoryStatusEx
GetLocalTime
CreateMemoryResourceNotification
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageA
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
CreateFileW
WriteFile
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
ResetEvent
ReleaseMutex
SetWaitableTimer
CreateWaitableTimerW
GetExitCodeProcess
ResumeThread
CreateProcessW
GetProcessId
OpenProcess
FormatMessageW
ExpandEnvironmentStringsW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenMutexW
FileTimeToLocalFileTime
GetProcessTimes
GetSystemTime
MultiByteToWideChar
GetCurrentThread
GetComputerNameW
GetModuleHandleW
GetSystemDirectoryW
GetSystemInfo
DecodePointer
DebugBreak
TlsAlloc
TlsGetValue
TlsSetValue
DeviceIoControl
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetExitCodeThread
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
GetConsoleOutputCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
Sections
.text Size: 639KB - Virtual size: 638KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 600KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE