Static task
static1
Behavioral task
behavioral1
Sample
d044e612535b39aabdfe895b9529f012d2f715ab4f73783bbdf256cfc087c664.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
d044e612535b39aabdfe895b9529f012d2f715ab4f73783bbdf256cfc087c664.exe
Resource
win10v2004-20230703-en
General
-
Target
d044e612535b39aabdfe895b9529f012d2f715ab4f73783bbdf256cfc087c664
-
Size
7.8MB
-
MD5
9b0effa5c6ea351cf710818c66aeb36b
-
SHA1
f483b31462d88a6f1a069a45ee6a783e9e72d2f0
-
SHA256
d044e612535b39aabdfe895b9529f012d2f715ab4f73783bbdf256cfc087c664
-
SHA512
aa00d332eb4118d4cd04169db3d5b6dd181f292545bf24498b41d26fff7d7be620c3ce793ca7e62878abf2ca6a580b27e94fe2eed010cdc09ee2f7146b683e9d
-
SSDEEP
196608:h2S0bZs3NdlheC6/g7fXkqfFSzC82NviCrb9H1tZ/Z:hH01sdUC6/avtNQX4iCH3tJZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d044e612535b39aabdfe895b9529f012d2f715ab4f73783bbdf256cfc087c664
Files
-
d044e612535b39aabdfe895b9529f012d2f715ab4f73783bbdf256cfc087c664.exe windows x86
6daccec3f5b2c20668c24ccc3ab88471
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetCurrentProcessId
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassA
GetUpdateRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExtSelectClipRgn
CreateDIBitmap
winmm
midiStreamStop
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
DragQueryFileA
ole32
CLSIDFromString
CreateStreamOnHGlobal
oleaut32
UnRegisterTypeLi
VariantInit
comctl32
ord17
InitCommonControlsEx
ws2_32
closesocket
WSAStartup
comdlg32
GetFileTitleA
iphlpapi
GetAdaptersInfo
gdiplus
GdipGetPropertyItem
imm32
ImmGetContext
wtsapi32
WTSSendMessageW
Sections
IguT)Q^t Size: - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
LC&:/E!j Size: - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
6m`b<g]\ Size: - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
=?=bS.P/ Size: - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
sI`+OJUY Size: - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
#I5=W5dl Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
j8xRQ=YT Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
*s7Yk3Nd Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
yg"EP"E* Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T=Xnv'>_ Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
kLJb\0Qe Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
VhzsMD(L Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ