Static task
static1
Behavioral task
behavioral1
Sample
f1097a12a0b928a65d8577b7f94373ce7da748d012310a364db7ca2efe265333.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f1097a12a0b928a65d8577b7f94373ce7da748d012310a364db7ca2efe265333.exe
Resource
win10v2004-20230831-en
General
-
Target
f1097a12a0b928a65d8577b7f94373ce7da748d012310a364db7ca2efe265333
-
Size
9.7MB
-
MD5
1ba74c32118e9d9238b589038bf3ab64
-
SHA1
d627f91c5b2b727bdf096a474409d67fa280b1c1
-
SHA256
f1097a12a0b928a65d8577b7f94373ce7da748d012310a364db7ca2efe265333
-
SHA512
f5076ebc062f2e20a8816d15d5f0ffaa2eb1ab25d900832d05216b6bedfbf28c8675facaace473e08ce3d55b8b7db6e1460e11c4c2225c589b81bce34782d120
-
SSDEEP
196608:Mcx6nZvWX9nM+uwPGyEbU3F2MWragkJm+qSzcjDNM4R4aWZ48afVB/GQKKDVflw8:vsZvWNnM+gyEbU3F2MWra7Jm+qSziDNW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1097a12a0b928a65d8577b7f94373ce7da748d012310a364db7ca2efe265333
Files
-
f1097a12a0b928a65d8577b7f94373ce7da748d012310a364db7ca2efe265333.exe windows x86
610ec62215008d5752d1901a395ff1fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
LocalFree
lstrlenA
FormatMessageA
LocalAlloc
GetDiskFreeSpaceA
GetSystemDirectoryA
GetSystemInfo
ReadFile
GetEnvironmentVariableA
WaitForSingleObject
GetCurrentProcess
MultiByteToWideChar
FindClose
GetModuleHandleA
FindFirstFileA
MoveFileExA
SetFileAttributesA
GetFileAttributesA
RemoveDirectoryA
GetTickCount
GetFileAttributesExA
CreateProcessA
GetStartupInfoA
CreatePipe
WriteConsoleW
SetStdHandle
OpenProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
OpenMutexA
CreateEventA
SetEvent
GetModuleFileNameA
DeleteFileA
MoveFileA
GetWindowsDirectoryA
CopyFileA
GetPrivateProfileIntA
LoadLibraryExA
GetProcAddress
Sleep
CreateDirectoryA
GetLocalTime
CreateFileA
GetLastError
SetFilePointer
CreateFileW
WriteFile
GetCurrentThreadId
CloseHandle
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
FindNextFileA
LoadLibraryW
FreeLibrary
GetExitCodeProcess
GetConsoleMode
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetConsoleCP
user32
ExitWindowsEx
advapi32
EqualSid
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
RegDeleteValueA
QueryServiceConfigA
QueryServiceStatusEx
StartServiceA
SetServiceStatus
LockServiceDatabase
QueryServiceLockStatusA
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateGuid
Sections
.text Size: 287KB - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ