Static task
static1
Behavioral task
behavioral1
Sample
996671fbec17d869ed31bebc5c8a2eef7ae4d5d62b08a4ed4eaaadfa63ae8afe.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
996671fbec17d869ed31bebc5c8a2eef7ae4d5d62b08a4ed4eaaadfa63ae8afe.exe
Resource
win10v2004-20230703-en
General
-
Target
996671fbec17d869ed31bebc5c8a2eef7ae4d5d62b08a4ed4eaaadfa63ae8afe
-
Size
165KB
-
MD5
a624f115bcc7fe2400d6d3568c8295bc
-
SHA1
c0e9ef9439b77705021de310501c37642696c95d
-
SHA256
996671fbec17d869ed31bebc5c8a2eef7ae4d5d62b08a4ed4eaaadfa63ae8afe
-
SHA512
eb3355f5b97c366c6ea88bbc87e0384a4dfa6eb2f74c324d87ce077dc04e047b55f849b191b226930f2bf7b79964ab274cb0be8d4cdaf30a50e94c45f8dd76ec
-
SSDEEP
3072:W1f58ovDIA1azeGM2ZuYSOo8iGcSdpQEBkrRiGGl2SzZrISK:28oLxL2ZuYS1WcQarRioujK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 996671fbec17d869ed31bebc5c8a2eef7ae4d5d62b08a4ed4eaaadfa63ae8afe
Files
-
996671fbec17d869ed31bebc5c8a2eef7ae4d5d62b08a4ed4eaaadfa63ae8afe.exe windows x86
fce2233f2b00f57a7debc9dac6233e0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
GetModuleFileNameA
SizeofResource
GetFileSizeEx
WriteProcessMemory
HeapFree
SetLastError
SetDefaultDllDirectories
GetCurrentProcess
WriteFile
TerminateProcess
LoadLibraryExA
InitializeProcThreadAttributeList
SetFilePointer
InitializeCriticalSectionEx
WaitForSingleObject
ResumeThread
GetModuleHandleA
OpenProcess
HeapSize
CreateToolhelp32Snapshot
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
GetModuleHandleExA
GetTickCount64
GetLastError
UpdateProcThreadAttribute
GetFileAttributesA
Process32NextW
CreateFileA
LockResource
DeleteFileA
Process32FirstW
HeapReAlloc
CloseHandle
GetNativeSystemInfo
RaiseException
CreateThread
HeapSetInformation
FindResourceExW
LoadResource
DeleteProcThreadAttributeList
FindResourceW
HeapAlloc
VirtualProtectEx
DecodePointer
HeapDestroy
GetProcAddress
VirtualAllocEx
LocalFree
DeleteCriticalSection
ExitProcess
ReadProcessMemory
GetProcessHeap
FreeLibrary
FlushInstructionCache
WideCharToMultiByte
CreateRemoteThread
CreateProcessA
FormatMessageA
VirtualFreeEx
GetPrivateProfileIntA
GetPrivateProfileStringA
VirtualQueryEx
WriteConsoleW
GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetStringTypeW
FlushFileBuffers
ReadConsoleW
CreateFileW
SetEndOfFile
Sections
.text Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ