Static task
static1
Behavioral task
behavioral1
Sample
dfee62ef2403556ce0bed6fce2344b7b5737882f025da2b6a16bdceb3eb184e3.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dfee62ef2403556ce0bed6fce2344b7b5737882f025da2b6a16bdceb3eb184e3.exe
Resource
win10v2004-20230703-en
General
-
Target
dfee62ef2403556ce0bed6fce2344b7b5737882f025da2b6a16bdceb3eb184e3
-
Size
1.4MB
-
MD5
4f1a3b1eca5be3814dcce058c7a97449
-
SHA1
f40dacd0399887b41efccaf76352fe7f6ff12358
-
SHA256
dfee62ef2403556ce0bed6fce2344b7b5737882f025da2b6a16bdceb3eb184e3
-
SHA512
bfa83ccad6d0b30995bce6f4a46aad9a61435701c7e353d4a340f00e64ac7cb0d14a6a7f0f2ed0880ccfaa1f12cf90a868f872027a147f771e370744cf16e354
-
SSDEEP
12288:ChxM3DW7EM7thrE81rngo2hiibuuuyMyyhF8bqs95PCtD0VLJuc5Cc8fuysB+X2E:L+rR2lyhF8bqs95PCtYFuc5Cc8kH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfee62ef2403556ce0bed6fce2344b7b5737882f025da2b6a16bdceb3eb184e3
Files
-
dfee62ef2403556ce0bed6fce2344b7b5737882f025da2b6a16bdceb3eb184e3.exe windows x86
4e60da9d6a155ffec07069ce8d5c714b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
WaitForSingleObject
CreateMutexA
Sleep
WaitForMultipleObjects
TerminateProcess
CreateThread
CreateProcessA
OpenProcess
GetLocalTime
GetModuleFileNameA
GetModuleHandleW
CopyFileA
WideCharToMultiByte
CreateToolhelp32Snapshot
CreatePipe
Process32NextW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
SetConsoleCtrlHandler
GetLastError
SetHandleInformation
CloseHandle
GetTempFileNameA
GetTempPathA
WriteFile
ReadFile
GetFileAttributesA
GetFileSize
DeleteFileA
CreateFileA
CreateDirectoryA
Process32FirstW
GetCommandLineW
WriteConsoleW
OutputDebugStringW
HeapQueryInformation
HeapSize
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetStdHandle
GetSystemInfo
HeapValidate
GetModuleHandleExW
SetEndOfFile
ExitProcess
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
HeapAlloc
HeapFree
VirtualQuery
FreeLibrary
GetProcAddress
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
GetMessageW
DispatchMessageW
GetKeyState
GetSystemMetrics
GetForegroundWindow
GetDC
ReleaseDC
GetWindowTextA
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
TranslateMessage
gdi32
CreateDIBSection
SelectObject
GetCurrentObject
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
GetObjectW
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
shell32
ShellExecuteA
SHGetKnownFolderPath
CommandLineToArgvW
shlwapi
PathStripPathA
wininet
HttpSendRequestExA
InternetConnectA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetWriteFile
HttpEndRequestA
InternetOpenA
ws2_32
WSAGetLastError
WSACleanup
gethostname
gethostbyname
WSAConnect
closesocket
htons
inet_addr
inet_ntoa
WSAStartup
send
WSASocketA
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ