Static task
static1
Behavioral task
behavioral1
Sample
92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497.exe
Resource
win10v2004-20230703-en
General
-
Target
92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497.exe
-
Size
922KB
-
MD5
c6a2fb56239614924e2ab3341b1fbba5
-
SHA1
bdd2ecf290406b8a09eb01016c7658a283c407c3
-
SHA256
92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497
-
SHA512
cbf85b0c97038fbbe48deedc6ae8f173f8a65ce8c0da6e2f0533a9aea1f55eb8783bed6a171315bd6305d57c43887a0cd10eee379657e0c7e8e0ffb8850b4517
-
SSDEEP
24576:diQZitpSzuX+gltfyZE25LQv77cMhi7eobIMUGDM5Lna:rZif7+OyZEREei7eob8mM5La
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497.exe
Files
-
92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497.exe.exe windows x86
d0cbfb70904a6c2c4f1d40179a3943a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetCurrentProcess
WriteFile
VirtualAlloc
InterlockedDecrement
CreateNamedPipeW
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
CreateToolhelp32Snapshot
CreateEventW
Sleep
GetLastError
Process32NextW
SetEvent
TerminateThread
LoadLibraryA
EnterCriticalSection
DeleteFileW
Process32FirstW
CloseHandle
CreateThread
LoadResource
FindResourceW
GetOverlappedResult
GetProcAddress
VirtualAllocEx
DeleteCriticalSection
CreateProcessW
GetModuleHandleW
FreeLibrary
CopyFileW
CreateRemoteThread
InterlockedIncrement
GetTickCount
VirtualQuery
ConnectNamedPipe
ReadConsoleW
SetEndOfFile
VirtualProtect
WriteProcessMemory
GetFileSizeEx
CancelIo
SizeofResource
LockResource
ReadFile
HeapReAlloc
HeapSize
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
GetProcessHeap
GetStringTypeW
GetFileType
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer
RaiseException
SetLastError
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleCP
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
DecodePointer
user32
wsprintfW
advapi32
AdjustTokenPrivileges
LookupPrivilegeNameW
OpenProcessToken
GetTokenInformation
iphlpapi
GetAdaptersInfo
ws2_32
closesocket
select
WSAStartup
__WSAFDIsSet
connect
htonl
htons
ioctlsocket
WSACleanup
socket
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 790KB - Virtual size: 790KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ