Static task
static1
Behavioral task
behavioral1
Sample
a22924825e58403c908482018a8624cf49131ddaf3dbd18c638a31fa381ee737.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a22924825e58403c908482018a8624cf49131ddaf3dbd18c638a31fa381ee737.exe
Resource
win10v2004-20230703-en
General
-
Target
a22924825e58403c908482018a8624cf49131ddaf3dbd18c638a31fa381ee737
-
Size
24KB
-
MD5
3e441ded4c067364799d914185cb656d
-
SHA1
8d5309f9e0cd14d346de229aabb9779657a1710e
-
SHA256
a22924825e58403c908482018a8624cf49131ddaf3dbd18c638a31fa381ee737
-
SHA512
e3eeb18b47272a31a84baa2397010652e7fa97a7a310db898044c7ec0f3be920a240e4f72ae13eaf230d7b791a5e851def6ee76192c37ffceb73d85970a7672a
-
SSDEEP
384:qNd4hd2MDuV6U3sridGesI847ZnDM6EiHozX160YjHvodK2mGv5DZdfAyqxM:qD432AXU3TDNEiHoZ604wdVBDdqxM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a22924825e58403c908482018a8624cf49131ddaf3dbd18c638a31fa381ee737
Files
-
a22924825e58403c908482018a8624cf49131ddaf3dbd18c638a31fa381ee737.exe windows x86
414c1db00497e20d7c230c0594d24c59
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140u
ord12586
ord2885
ord5886
ord265
ord12351
ord14606
ord266
ord5110
ord11962
ord995
ord1472
ord1045
ord6555
ord5512
ord5514
ord494
ord1142
ord500
ord8360
ord8757
ord8756
ord12884
ord12763
ord2990
ord5921
ord285
ord3009
ord2304
ord2408
ord4815
ord286
ord1525
ord5109
ord296
ord280
ord1523
ord12784
ord12559
ord1513
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringW
LocalFree
FormatMessageW
GetLastError
DeleteFileW
GetConsoleWindow
GetCommandLineW
GetTempPathW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcess
SetCurrentDirectoryW
WaitForSingleObject
Sleep
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
user32
MessageBoxW
SetWindowTextW
ExitWindowsEx
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shell32
ShellExecuteExW
shlwapi
PathAddBackslashW
PathCanonicalizeW
PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW
gvbioslib
GvFreeBiosLib
GvInitBiosLib
GvReadBiosInfoFromAdapterW
GvCheckMatchOfBIOSVersionW
vcruntime140
_except_handler4_common
__current_exception
memset
__CxxFrameHandler3
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vfwprintf
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
__p___argc
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ