Static task
static1
Behavioral task
behavioral1
Sample
79651a0b091afd76acc3acc95a9cf5fc12804b08ec6d2e42a74cf7451c6ef19d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
79651a0b091afd76acc3acc95a9cf5fc12804b08ec6d2e42a74cf7451c6ef19d.exe
Resource
win10v2004-20230703-en
General
-
Target
79651a0b091afd76acc3acc95a9cf5fc12804b08ec6d2e42a74cf7451c6ef19d
-
Size
445KB
-
MD5
c8736b7818a25f5248f78f8b7246b1cd
-
SHA1
b04295a3200858b5583295dc18dde42997384f15
-
SHA256
79651a0b091afd76acc3acc95a9cf5fc12804b08ec6d2e42a74cf7451c6ef19d
-
SHA512
2e709cdf97689301129d6fd4c4bf40c28567756ab0a5f8a6c80e744c03583a8d1e9d6892acfb544317cc38a8a2191bc190fd926fb6b8f65c42e65f94717129be
-
SSDEEP
6144:I9cfDYG74rtWXtvjt3tQEPqlD+CTP8RO9WcG3IPe0IBXC2m4T74:I27YGqgjB6Qgko9WcG4dISL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79651a0b091afd76acc3acc95a9cf5fc12804b08ec6d2e42a74cf7451c6ef19d
Files
-
79651a0b091afd76acc3acc95a9cf5fc12804b08ec6d2e42a74cf7451c6ef19d.exe windows x64
3b194bc414bce99baec122f58eca05c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
inet_ntop
ntohs
netapi32
NetUserEnum
NetApiBufferFree
iphlpapi
GetAdaptersInfo
GetTcpTable
GetUdpTable
GetTcp6Table
GetUdp6Table
GetAdaptersAddresses
ConvertLengthToIpv4Mask
winhttp
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryHeaders
WinHttpReadData
kernel32
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
Sleep
CreateFileW
GetDiskFreeSpaceExA
WriteFile
GetVolumeInformationA
CloseHandle
GetLastError
CreateProcessA
GlobalMemoryStatusEx
GetTickCount64
CreateToolhelp32Snapshot
Process32First
HeapAlloc
HeapFree
HeapReAlloc
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumeInformationW
QueryDosDeviceW
GetVolumePathNamesForVolumeNameW
GetComputerNameExW
GetNativeSystemInfo
GetComputerNameA
VerSetConditionMask
GlobalFree
VerifyVersionInfoW
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileType
IsValidCodePage
GetACP
SetFilePointerEx
GetProcessHeap
GetOEMCP
SetEnvironmentVariableW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
WriteConsoleW
Process32Next
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
GetCurrentDirectoryW
FindClose
FindFirstFileExW
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
advapi32
CryptAcquireContextA
RegOpenKeyExW
GetUserNameW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
Sections
.text Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ