Static task
static1
Behavioral task
behavioral1
Sample
fb7c14fcbdc2b07b106d44c17cc9deb0be8da630c8e4e60c58a85cbaf24320d1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fb7c14fcbdc2b07b106d44c17cc9deb0be8da630c8e4e60c58a85cbaf24320d1.exe
Resource
win10v2004-20230831-en
General
-
Target
fb7c14fcbdc2b07b106d44c17cc9deb0be8da630c8e4e60c58a85cbaf24320d1
-
Size
106KB
-
MD5
159e85c24f0145f2fe8002ea8fd9ae96
-
SHA1
12c249bc56ec308b2502e8fd5f1ed324ce6bf129
-
SHA256
fb7c14fcbdc2b07b106d44c17cc9deb0be8da630c8e4e60c58a85cbaf24320d1
-
SHA512
c9a32127e2192dcb7f920be04e10bfc0f2b4bf87144ac653614f212446ee185269845c53cc632c7b88f1f7a3bb5bcc7d8f09abc0c25204d7995dda04f5199f14
-
SSDEEP
1536:G9vMPNwyCW0DGu619yy7lt4KocOLcHWxrW:G9vMPNDCW/fyWJocOLcH4W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb7c14fcbdc2b07b106d44c17cc9deb0be8da630c8e4e60c58a85cbaf24320d1
Files
-
fb7c14fcbdc2b07b106d44c17cc9deb0be8da630c8e4e60c58a85cbaf24320d1.exe windows x64
4c2afa35ddd9deb2c7ed7784d007533d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc90
ord4313
ord4846
ord5003
ord1714
ord1713
ord1585
ord3131
ord6038
ord1433
ord4346
ord5323
ord4364
ord3265
ord362
ord316
ord798
ord617
ord266
ord1080
ord602
ord1977
ord1517
ord4196
ord2136
ord1581
ord3133
ord6041
ord1662
ord1659
ord4039
ord1434
ord4336
ord5272
ord1954
ord5191
ord6406
ord4285
ord5334
ord3488
ord4833
ord4384
ord1636
ord6086
ord5355
ord5353
ord936
ord941
ord945
ord943
ord947
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1556
ord6410
ord3893
ord6408
ord3430
ord5083
ord6012
ord3011
ord5302
ord5295
ord2010
ord1699
ord1698
ord1635
ord5320
ord2932
ord3069
ord4591
ord3253
ord583
ord1103
ord776
ord589
ord310
ord3921
ord1071
ord2067
ord6938
ord12010
ord12800
ord9578
ord10063
ord9910
ord12742
ord11771
ord12223
ord7372
ord9571
ord4136
ord4112
ord6409
ord3892
ord6407
ord4429
ord2110
ord1928
ord1938
ord1837
ord1840
ord4861
ord722
ord512
ord2218
ord2722
ord6366
ord2380
ord1149
ord2065
ord5701
ord3897
ord1023
ord5220
ord6348
ord5499
ord3923
ord1966
ord3002
ord5344
ord5346
ord8058
ord1516
ord795
ord2970
ord4041
ord4677
ord4689
ord778
ord3732
ord5350
ord5333
ord5684
ord2602
ord3413
ord3065
ord768
ord3974
ord5987
ord2937
ord6308
ord923
ord3169
ord642
ord2068
ord3137
ord393
ord2797
ord2904
ord4410
ord2780
ord2907
ord2605
ord2711
ord2598
ord3809
ord3810
ord3800
ord2709
ord4042
ord4586
ord4363
ord8878
ord6744
ord4648
ord3774
ord3529
ord1393
ord1237
msvcr90
_setmbcp
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
isxdigit
vsprintf_s
_strlwr
_strupr
realloc
_CxxThrowException
atol
malloc
free
__CxxFrameHandler3
strrchr
memset
_stricmp
strchr
strstr
kernel32
MultiByteToWideChar
GetLastError
Sleep
GetCurrentThreadId
FormatMessageA
lstrlenA
GetTickCount
LocalFree
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
GetSystemDirectoryA
TerminateProcess
GetTempPathA
lstrcpyA
FindFirstFileA
FindClose
WideCharToMultiByte
user32
SendMessageA
DrawIcon
IsIconic
GetClientRect
wsprintfA
LockWindowUpdate
PostQuitMessage
GetSystemMetrics
LoadIconA
EnableWindow
advapi32
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ