Static task
static1
Behavioral task
behavioral1
Sample
0ccd7c802a19390e02e8542ba79315899186723f732caa353260fc7b2ce3a517.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0ccd7c802a19390e02e8542ba79315899186723f732caa353260fc7b2ce3a517.exe
Resource
win10v2004-20230703-en
General
-
Target
0ccd7c802a19390e02e8542ba79315899186723f732caa353260fc7b2ce3a517
-
Size
644KB
-
MD5
2482ae36a6236967ebf49cfb8da8a534
-
SHA1
e3ffb7d72a2f35da980069a98a4770bd28c119d5
-
SHA256
0ccd7c802a19390e02e8542ba79315899186723f732caa353260fc7b2ce3a517
-
SHA512
1b272f63e765dda0fb7d097488b26738dc125b527ddebceea1291e80e3cf39f582ba548f7bdab1ed22800cdf36e61f913dc4edf99945451d035215c827f41fcc
-
SSDEEP
12288:mTfyDSXnYpRQUQMlYQB84U2D3JxVL1I1hSMXlF:mTQSXnjU9YQB84bD3zV5I1hSMXl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ccd7c802a19390e02e8542ba79315899186723f732caa353260fc7b2ce3a517
Files
-
0ccd7c802a19390e02e8542ba79315899186723f732caa353260fc7b2ce3a517.exe windows x64
92f3d1f47468cb00c114bbd7daa3a04a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winhttp
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryOption
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpSetStatusCallback
ws2_32
InetNtopW
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
kernel32
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableW
GetOEMCP
GetACP
GetConsoleOutputCP
GetFileSizeEx
GetStringTypeW
HeapSize
HeapReAlloc
IsValidCodePage
InitializeSRWLock
GetEnvironmentVariableW
CreateFileW
ReadFile
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
WriteFile
CloseHandle
GetLastError
GetFileInformationByHandleEx
GetFullPathNameW
SetHandleInformation
GetStdHandle
CreatePipe
WaitForSingleObject
CreateProcessW
GetExitCodeProcess
GetFileAttributesW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
FlsAlloc
FlsSetValue
FlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessTimes
GetCurrentProcess
GetCurrentProcessorNumber
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetLargePageMinimum
FreeLibrary
GetProcAddress
LoadLibraryW
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
WriteConsoleA
GetConsoleScreenBufferInfo
MultiByteToWideChar
FormatMessageW
LocalFree
GetModuleHandleW
SetConsoleMode
GetConsoleMode
WriteConsoleW
GetFileType
LCMapStringW
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
FlsGetValue
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetCPInfo
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
Sections
.text Size: 382KB - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 226KB - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ