Static task
static1
Behavioral task
behavioral1
Sample
c8cba4f2154c5c6040b9947264b3995bb8176db36331546fafd87993a55f55bd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c8cba4f2154c5c6040b9947264b3995bb8176db36331546fafd87993a55f55bd.exe
Resource
win10v2004-20230831-en
General
-
Target
c8cba4f2154c5c6040b9947264b3995bb8176db36331546fafd87993a55f55bd
-
Size
878KB
-
MD5
26c1c7a65bdcd0602d129294ede11408
-
SHA1
e6f543012ee379d6c125f1d6d617cc8259ff7989
-
SHA256
c8cba4f2154c5c6040b9947264b3995bb8176db36331546fafd87993a55f55bd
-
SHA512
39889cbaeaee8dc265617334cbd206023bd14cffcb8fae584817fe35442567eca1c3a4a070f33771713d524f2d3643b0ca4df78c4af678fa6c62f9fb0dd383e8
-
SSDEEP
24576:Hwlm15kIAcwm+CaD22222227FEvlEKSlCnFx7PRPGqPxMJpt2dETOX49llUD:Ql655Acr+CaoEveKSi3RPz6Jpt27o94
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8cba4f2154c5c6040b9947264b3995bb8176db36331546fafd87993a55f55bd
Files
-
c8cba4f2154c5c6040b9947264b3995bb8176db36331546fafd87993a55f55bd.exe windows x86
233ec6a184e065baea71d903b3e77bcf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
shlwapi
PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW
StrStrIW
PathFindFileNameW
kernel32
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
DeleteFileW
GetModuleFileNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetFileAttributesW
Sleep
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateFileW
GetFileAttributesExW
FindFirstFileW
ReadFile
DeviceIoControl
GetTickCount
WriteFile
SetFilePointer
GetCurrentProcess
RemoveDirectoryW
FindNextFileW
FindClose
InitializeCriticalSectionAndSpinCount
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
GetVersion
GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ExpandEnvironmentStringsW
GetLongPathNameW
GetLocalTime
CreateDirectoryW
LoadLibraryW
SetFileAttributesW
FreeLibrary
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
MoveFileExW
CopyFileW
VirtualAlloc
VirtualFree
MoveFileW
OutputDebugStringW
IsDebuggerPresent
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
DecodePointer
WriteConsoleW
GetProcAddress
GetModuleHandleW
GetLastError
RaiseException
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetFileType
GetStringTypeW
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetACP
advapi32
RegCreateKeyExW
RegDeleteKeyW
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 201KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 576KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE