Static task
static1
Behavioral task
behavioral1
Sample
6ddd782203dec747fae4430cb1e9572e1841e7fdb2cde7dde22d42b4324685ae.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6ddd782203dec747fae4430cb1e9572e1841e7fdb2cde7dde22d42b4324685ae.exe
Resource
win10v2004-20230703-en
General
-
Target
6ddd782203dec747fae4430cb1e9572e1841e7fdb2cde7dde22d42b4324685ae
-
Size
1.2MB
-
MD5
71564ffaedc56194b723fe9df49a37c2
-
SHA1
2393992f3de525413e4f3b29967dd70fd20524b4
-
SHA256
6ddd782203dec747fae4430cb1e9572e1841e7fdb2cde7dde22d42b4324685ae
-
SHA512
5c559acd7daf38c2c127228c3ec6fbd80297baa977f4d1bdb3f1be3f547c55e6097df68b51ae92f457107df6167a5a6299839854269a1624ae3e421387f56df4
-
SSDEEP
24576:74eeG7chs1rKl4OLnspBEJ7VOaV/Qn652AO/TFdZs:8xY/1rpe6BO7VTCiQQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6ddd782203dec747fae4430cb1e9572e1841e7fdb2cde7dde22d42b4324685ae
Files
-
6ddd782203dec747fae4430cb1e9572e1841e7fdb2cde7dde22d42b4324685ae.exe windows x64
4eb09a1292de343b3e777f085d54ab11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
RtlUnwindEx
NtCancelIoFileEx
RtlCaptureContext
RtlLookupFunctionEntry
NtWriteFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
RtlPcToFileHeader
kernel32
CheckRemoteDebuggerPresent
IsDebuggerPresent
WaitForSingleObject
GetLastError
GetExitCodeProcess
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapReAlloc
GetProcessHeap
HeapAlloc
SystemTimeToFileTime
HeapFree
SwitchToThread
SetFilePointerEx
GetConsoleOutputCP
SetLastError
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
FlsFree
SystemTimeToTzSpecificLocalTime
WakeAllConditionVariable
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
GetFileType
GetSystemInfo
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TlsFree
FreeLibrary
SetStdHandle
SetEnvironmentVariableW
SetHandleInformation
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
CreateFileW
GetFullPathNameW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsSetValue
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
LoadLibraryExW
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WriteFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
WakeConditionVariable
PostQueuedCompletionStatus
FindNextFileW
FindFirstFileExW
TerminateProcess
TlsGetValue
GetCurrentProcess
FindClose
GetCommandLineW
GetModuleHandleExW
CompareStringOrdinal
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
crypt32
CertDuplicateStore
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertOpenStore
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
user32
MessageBoxW
ws2_32
connect
setsockopt
WSASend
WSASocketW
bind
getsockopt
freeaddrinfo
WSAStartup
WSACleanup
closesocket
recv
send
getaddrinfo
WSAIoctl
getsockname
WSAGetLastError
getpeername
shutdown
ioctlsocket
secur32
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
ApplyControlToken
QueryContextAttributesW
AcquireCredentialsHandleA
advapi32
RegQueryValueExW
RegCloseKey
SystemFunction036
RegOpenKeyExW
bcrypt
BCryptGenRandom
Sections
.text Size: 750KB - Virtual size: 750KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 449KB - Virtual size: 449KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ