Static task
static1
Behavioral task
behavioral1
Sample
6e3b65502b54de809e00b01548cd227550dda7323aa8e745f394e46187960875.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6e3b65502b54de809e00b01548cd227550dda7323aa8e745f394e46187960875.exe
Resource
win10v2004-20230703-en
General
-
Target
6e3b65502b54de809e00b01548cd227550dda7323aa8e745f394e46187960875
-
Size
155KB
-
MD5
e60898ced02498ab57b42e5ed1197ffb
-
SHA1
91d93ae8f7f4e4230c92d8fd7cfe76c7e4f7bbf6
-
SHA256
6e3b65502b54de809e00b01548cd227550dda7323aa8e745f394e46187960875
-
SHA512
4d6a0eb42830306b5b1b3705da681f2c1dfdfa7ce47df23e266f0af80e395f8b2e060dd8c614f330e47072f8bc3393ce65c99a55805c49f6b6008229975f60be
-
SSDEEP
1536:3SMn50FCw4wUSltrgqQ7wOto4MJyCu1HuPMpiYtunpUtsyo0c/VB:3SMnCMwBr1Q7wOGNyCu7eUD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e3b65502b54de809e00b01548cd227550dda7323aa8e745f394e46187960875
Files
-
6e3b65502b54de809e00b01548cd227550dda7323aa8e745f394e46187960875.exe windows x86
7c0277e95ccb066c7f99bfa815b701fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
CloseHandle
CompareFileTime
CompareStringW
CopyFileW
CreateDirectoryW
CreateFileW
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
GetCommandLineW
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileAttributesW
GetFileTime
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
ReadFile
SetFileAttributesW
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcatW
lstrcmpW
lstrcpyW
lstrlenW
msvcrt
__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
_wcmdln
_wcsdup
_wfopen
_wsplitpath
_wtol
abort
bsearch
calloc
exit
fclose
feof
fgetws
fprintf
free
fwrite
malloc
memcmp
memmove
signal
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
toupper
vfprintf
wcschr
wcscpy
wcsrchr
wcsstr
user32
CharUpperBuffW
LoadStringW
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 22KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rossym Size: 35KB - Virtual size: 34KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ