Static task
static1
Behavioral task
behavioral1
Sample
2efa01197397a4eba397c5d105305dd2a8bede06e54d51dc2de029ca4612a51e.exe
Resource
win7-20230831-en
General
-
Target
2efa01197397a4eba397c5d105305dd2a8bede06e54d51dc2de029ca4612a51e
-
Size
1.4MB
-
MD5
c7c9bb89d54036c9042116d8557e7fea
-
SHA1
97c39d68483af9fefd4a836abb81732fd766dd48
-
SHA256
2efa01197397a4eba397c5d105305dd2a8bede06e54d51dc2de029ca4612a51e
-
SHA512
adf85bec000fdd455da18593b4406fa5bd3487bc0a4cbea17a1e1820a9c44f3b5ea7d001461c5ec0b504917b22ff187b001d98ccf3e89e8da1d5fdec23df2b34
-
SSDEEP
24576:LGM3hiu55D7Hsd55M5uClkdcQBgzH0dClkdcQBgzH0NsqjnhMgeiCl7G0nehbGZd:LGM3hiu5hHsd3M5uClkdcQBgzH0dClkc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2efa01197397a4eba397c5d105305dd2a8bede06e54d51dc2de029ca4612a51e
Files
-
2efa01197397a4eba397c5d105305dd2a8bede06e54d51dc2de029ca4612a51e.exe windows x64
6837f1aafc853e98b3e8c0355f4cf1b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
shlwapi
PathFileExistsW
kernel32
ReadConsoleW
FindFirstFileW
FreeResource
FindResourceW
LoadResource
SizeofResource
GetModuleFileNameW
lstrlenW
LockResource
CreateDirectoryW
GetTempPathW
GetLastError
CreateSemaphoreW
GetCurrentThreadId
CloseHandle
SetStdHandle
WaitForSingleObject
GetPrivateProfileStringW
QueryFullProcessImageNameW
K32GetModuleFileNameExW
OpenProcess
Sleep
GetExitCodeProcess
WritePrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileIntW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
WriteConsoleW
CreateFileW
SetEndOfFile
MoveFileExW
GetCommandLineW
OutputDebugStringW
LoadLibraryExW
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetStringTypeW
HeapFree
HeapAlloc
FindFirstFileExW
FindNextFileW
FindClose
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCPInfo
RemoveDirectoryW
DeleteFileW
GetSystemTimeAsFileTime
SetEnvironmentVariableA
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
GetStdHandle
GetFileType
GetProcessHeap
ExitProcess
GetModuleHandleExW
WriteFile
ReadFile
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
advapi32
RegCloseKey
RegCreateKeyExW
RegSetValueExW
shell32
ord680
ShellExecuteW
ShellExecuteExW
SHFileOperationW
Sections
.text Size: 327KB - Virtual size: 326KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 381KB - Virtual size: 381KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE