Static task
static1
Behavioral task
behavioral1
Sample
4ad009b6533a63bcec075f453bf5f1aee081ba9d2e573f3418814074dab74a7b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4ad009b6533a63bcec075f453bf5f1aee081ba9d2e573f3418814074dab74a7b.exe
Resource
win10v2004-20230831-en
General
-
Target
4ad009b6533a63bcec075f453bf5f1aee081ba9d2e573f3418814074dab74a7b
-
Size
451KB
-
MD5
f64b822b2db6ad4f12a7a333a725f7fb
-
SHA1
d791685897df94525aeb882d592d220ebdd7d710
-
SHA256
4ad009b6533a63bcec075f453bf5f1aee081ba9d2e573f3418814074dab74a7b
-
SHA512
3ee0b12176d08007658181a6e4d9f7f77a66b8fdd56430f56b99a4cd07e501a290ec5a94b74105d3e8b8e802f4a9c54ecae16a2bca966bcc70379437cf75a11f
-
SSDEEP
6144:urN5JOjlpCxwdXt7nZn15EOow7KNbXhreb0RMrs8TvtJhrzaXOQohcEP:cKHnZzotRXhqb0ROsmlzPQo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ad009b6533a63bcec075f453bf5f1aee081ba9d2e573f3418814074dab74a7b
Files
-
4ad009b6533a63bcec075f453bf5f1aee081ba9d2e573f3418814074dab74a7b.exe windows x64
d172ad467cd91a31c3db5a7a861018c1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
shlwapi
PathCanonicalizeW
shell32
SHFileOperationW
SHGetFolderPathW
kernel32
TlsAlloc
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
HeapQueryInformation
HeapSize
HeapReAlloc
ReadConsoleW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCommandLineW
GetCommandLineA
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
LoadLibraryExW
SetLastError
RtlPcToFileHeader
RtlUnwindEx
GetStringTypeW
WideCharToMultiByte
GetCurrentDirectoryW
OutputDebugStringW
MultiByteToWideChar
SwitchToThread
GetCurrentThreadId
TlsGetValue
TlsSetValue
GetLastError
GetModuleFileNameW
GetModuleHandleW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFullPathNameW
GetTempFileNameW
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
WriteFile
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
SleepEx
WaitForSingleObjectEx
SetWaitableTimer
CreateWaitableTimerExW
GetSystemTime
LocalFree
FormatMessageW
CopyFileW
MoveFileExW
ReplaceFileW
SystemTimeToFileTime
RaiseException
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
WriteConsoleW
TlsFree
FreeLibrary
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
Sections
.text Size: 319KB - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ