Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_2d56a50295b38a0a0d1c18cc329ab646_xiaoba_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_2d56a50295b38a0a0d1c18cc329ab646_xiaoba_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_2d56a50295b38a0a0d1c18cc329ab646_xiaoba_JC.exe
-
Size
3.5MB
-
MD5
2d56a50295b38a0a0d1c18cc329ab646
-
SHA1
7d25d13a656534579d7aa235fb9bc64be507782d
-
SHA256
85b021d805855acb2b7960dbca858e961c1ae927a88ad3ba2278220bcc9e245a
-
SHA512
7c6549171c51b000690bb915a54dca2ce5971beb9294c45f9c31a267f74e3388ddb3d02d831d6f5b8f2b1598a3e1ea5e01745132de16fddbd16131f4be809d70
-
SSDEEP
98304:rIFb6dDtyxvKGOIzGf77JLcbyptBWTGsMFc5JX5yG9nuW8esS7kj326:wxqhLcbyrQTGsMFc5JX5yG9nuW8ZjR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-23_2d56a50295b38a0a0d1c18cc329ab646_xiaoba_JC.exe
Files
-
2023-08-23_2d56a50295b38a0a0d1c18cc329ab646_xiaoba_JC.exe.exe windows x86
ab9d76ccbe176a467a22a12cd7e19fd9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundA
ws2_32
gethostname
rasapi32
RasGetConnectStatusA
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetTimeZoneInformation
user32
GetSysColorBrush
gdi32
CreateDCA
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_Destroy
wininet
HttpSendRequestA
msvcrt
malloc
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 2.0MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sedata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ