Static task
static1
Behavioral task
behavioral1
Sample
dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13.exe
Resource
win10v2004-20230703-en
General
-
Target
dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13
-
Size
1.7MB
-
MD5
7e6b2abd5cb72394f7ee4e2a7ae9d341
-
SHA1
b3fb7caecc5740a002f7ce7b8686bbc3a0d277ad
-
SHA256
dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13
-
SHA512
1e2b2de049a22a543c178583528c75bbf141a212ae6184cdbaeaece55974c5d3b03d0222b3aab44c55dec5e22387e6b69b6a4ca3e568b4e999cb842e070af258
-
SSDEEP
49152:rZshVjrZHNgWmABIrdHtAptgbeDyQ5rp:erl+Wm4pptgblQ5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13
Files
-
dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13.exe windows x64
159e926fcbaec5660cfcf1259c234341
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHDeleteKeyW
kernel32
TlsAlloc
WriteConsoleW
GetCurrentDirectoryW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
GlobalMemoryStatusEx
GetLocalTime
CreateMemoryResourceNotification
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageA
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
CreateFileW
WriteFile
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
ResetEvent
ReleaseMutex
SetWaitableTimer
CreateWaitableTimerW
GetExitCodeProcess
ResumeThread
CreateProcessW
GetProcessId
OpenProcess
FormatMessageW
ExpandEnvironmentStringsW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenMutexW
FileTimeToLocalFileTime
GetProcessTimes
GetSystemTime
MultiByteToWideChar
GetCurrentThread
GetComputerNameW
GetSystemDirectoryW
GetModuleHandleW
GetSystemInfo
GetStdHandle
DebugBreak
RtlUnwind
TlsGetValue
TlsSetValue
DeviceIoControl
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetExitCodeThread
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
GetConsoleOutputCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
RtlPcToFileHeader
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
Sections
.text Size: 769KB - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE