Static task
static1
Behavioral task
behavioral1
Sample
6db4099211c195cc4e053080409372a2c25a4aad1f993366b5197f58ec08e8cb.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6db4099211c195cc4e053080409372a2c25a4aad1f993366b5197f58ec08e8cb.exe
Resource
win10v2004-20230831-en
General
-
Target
6db4099211c195cc4e053080409372a2c25a4aad1f993366b5197f58ec08e8cb
-
Size
124KB
-
MD5
e23dc9896700d349a4041fe7e2fd4065
-
SHA1
a7491d686c3e4284ec72e659e2ea3686e63a3e6f
-
SHA256
6db4099211c195cc4e053080409372a2c25a4aad1f993366b5197f58ec08e8cb
-
SHA512
46b8a4227fb4691a290dc6b7e5b65f8cace0130e2776f0e64283864a0b4e1c4f8e4957eb7f6d4c32c089a763fe5dbc5a01196fa4f17eb9e2f2149664c3feae6d
-
SSDEEP
3072:d3TkIqTQSp1Qas1sjiLTTWzVNqry9Fmv6Baf5TVZPmK:hYIqHpvjinqLqzv6B0XPv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6db4099211c195cc4e053080409372a2c25a4aad1f993366b5197f58ec08e8cb
Files
-
6db4099211c195cc4e053080409372a2c25a4aad1f993366b5197f58ec08e8cb.exe windows x64
259c55c733ee2a62dd53b04660e4e9d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WideCharToMultiByte
FindClose
FindFirstFileA
GetShortPathNameA
CloseHandle
CreateFileA
lstrcpyA
GetModuleFileNameA
SetLastError
TerminateProcess
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
SetFilePointer
FlushFileBuffers
SetStdHandle
GetPrivateProfileSectionA
WritePrivateProfileSectionA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
GetLastError
GetCurrentThreadId
LocalFree
Sleep
GetProcAddress
LoadLibraryA
lstrlenA
WritePrivateProfileStringA
GetTickCount
GetPrivateProfileIntA
WinExec
DeleteFileA
FreeEnvironmentStringsW
SetEndOfFile
GetEnvironmentStringsW
GetEnvironmentStrings
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
HeapSize
GetCurrentProcessId
QueryPerformanceCounter
FreeEnvironmentStringsA
ReadFile
ExitProcess
GetModuleHandleW
GetConsoleMode
GetConsoleCP
WriteFile
HeapCreate
HeapSetInformation
GetFileType
HeapFree
GetProcessHeap
RtlLookupFunctionEntry
RtlUnwindEx
GetSystemTimeAsFileTime
HeapAlloc
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
RaiseException
RtlPcToFileHeader
HeapReAlloc
GetCommandLineA
GetStartupInfoA
LCMapStringA
LCMapStringW
GetCPInfo
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetHandleCount
GetStdHandle
user32
DefWindowProcA
PostMessageA
CreateWindowExA
DestroyWindow
DispatchMessageA
RegisterClassExA
GetMessageA
wsprintfA
TranslateMessage
PostQuitMessage
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
oleaut32
VariantClear
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ