Static task
static1
Behavioral task
behavioral1
Sample
190443cbf65c0898f914fc760934caea.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
190443cbf65c0898f914fc760934caea.exe
Resource
win10v2004-20230703-en
General
-
Target
190443cbf65c0898f914fc760934caea.exe
-
Size
517KB
-
MD5
190443cbf65c0898f914fc760934caea
-
SHA1
2038226438b0d02d675bde2253866329c69af1e6
-
SHA256
3922b22af71946fc376884c6bd78cb725e903456a3e5481819b55312c745367f
-
SHA512
03bc60cb328d59d40dcd6270f058ebdbd3d1fbed0e86f28cd357179c95c7f89fdb9bf35cc1020b834c6eaeeb631500814a90169d02c6f2334db3d0451b8b3544
-
SSDEEP
6144:EdmZWccb2kii5Z44P/fBlqjQJWYgARXIQ6BDDm5nYh6i74H:qmYHfia44PvqIdPXJ6BfInxi7i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 190443cbf65c0898f914fc760934caea.exe
Files
-
190443cbf65c0898f914fc760934caea.exe.exe windows x64
f3fdd2fad38061d0ad3658e2a88734f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
PathFileExistsW
kernel32
UnhandledExceptionFilter
GetCurrentProcess
CloseHandle
IsDebuggerPresent
SizeofResource
WriteProcessMemory
WriteFile
WaitForSingleObject
CreateFileW
GetSystemDirectoryW
RtlVirtualUnwind
Sleep
lstrcatW
DeleteFileW
LoadLibraryW
LoadResource
FindResourceW
GetWindowsDirectoryW
VirtualAllocEx
CreateProcessW
CreateRemoteThread
VirtualProtect
K32GetModuleInformation
GetProcAddress
CreateFileMappingW
MapViewOfFile
RtlLookupFunctionEntry
SetUnhandledExceptionFilter
TerminateProcess
GetModuleHandleExW
FreeLibrary
ExitProcess
GetModuleHandleW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
RtlCaptureContext
user32
MessageBoxW
shell32
ShellExecuteW
msvcrt
__argc
__argv
?_set_new_mode@@YAHH@Z
_commode
_msize
?terminate@@YAXXZ
realloc
__getmainargs
__set_app_type
_XcptFilter
_errno
free
_initterm
malloc
memset
__C_specific_handler
_fmode
_environ
memcpy
_amsg_exit
__CxxFrameHandler
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 769KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 496KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ