Static task
static1
Behavioral task
behavioral1
Sample
dff204270e0e95a7b8f0e40fcdf45b8149c7417f3068773697336e9eedf6441a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dff204270e0e95a7b8f0e40fcdf45b8149c7417f3068773697336e9eedf6441a.exe
Resource
win10v2004-20230831-en
General
-
Target
dff204270e0e95a7b8f0e40fcdf45b8149c7417f3068773697336e9eedf6441a
-
Size
313KB
-
MD5
1b173ea4d7e6bfec865a72f97f788b9b
-
SHA1
1121020c2ea7fa798f28f787d88265cc0b6eacb1
-
SHA256
dff204270e0e95a7b8f0e40fcdf45b8149c7417f3068773697336e9eedf6441a
-
SHA512
42998b78401c24f4d706a834c09c932f8b0c10fe9083fd3ce4c804b3c9010f60834d464525d81714f33d69555718ef012f450be9351424b777675596cadf793a
-
SSDEEP
6144:wHzlGQQmKCN8T/Qt814bEM8OBUWTcq7hNWInoh7Es:glGQaCNwy44bEROBUBOnop
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dff204270e0e95a7b8f0e40fcdf45b8149c7417f3068773697336e9eedf6441a
Files
-
dff204270e0e95a7b8f0e40fcdf45b8149c7417f3068773697336e9eedf6441a.exe windows x64
fd5c0b38e45ccb641d77e12afc655e4b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
shlwapi
PathCanonicalizeW
shell32
SHGetFolderPathW
SHFileOperationW
bcrypt
BCryptGenRandom
kernel32
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
HeapQueryInformation
HeapSize
HeapReAlloc
GetFileType
LCMapStringW
CompareStringW
GetCommandLineW
GetCommandLineA
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleExW
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
LoadLibraryExW
SetLastError
RtlPcToFileHeader
RtlUnwindEx
GetStringTypeW
WideCharToMultiByte
GetCurrentDirectoryW
OutputDebugStringW
GetCurrentProcessId
TlsGetValue
TlsSetValue
GetLastError
GetModuleFileNameW
MultiByteToWideChar
CloseHandle
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFullPathNameW
GetTempFileNameW
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
WriteFile
SleepEx
WaitForSingleObjectEx
SetWaitableTimer
CreateWaitableTimerExW
GetSystemTime
CopyFileW
MoveFileExW
ReplaceFileW
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
HeapAlloc
HeapFree
GetProcessHeap
LocalFree
FormatMessageW
RaiseException
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
WriteConsoleW
TlsAlloc
TlsFree
FreeLibrary
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetCPInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
Sections
.text Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ