Static task
static1
Behavioral task
behavioral1
Sample
af5a5919a4dcbb57d4477403b32373569a3394c946eb9d286a0438c371b173f9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
af5a5919a4dcbb57d4477403b32373569a3394c946eb9d286a0438c371b173f9.exe
Resource
win10v2004-20230915-en
General
-
Target
af5a5919a4dcbb57d4477403b32373569a3394c946eb9d286a0438c371b173f9
-
Size
13.9MB
-
MD5
5beb073985ea5e9d3d84f4549c10799a
-
SHA1
ef9c99ed1ac478e7e2b8c3fd5432c1f18a3a5fc5
-
SHA256
af5a5919a4dcbb57d4477403b32373569a3394c946eb9d286a0438c371b173f9
-
SHA512
45a40cf296e0dfc4f965fdb0f4bbc1183058ebd01c5b1338037d50c089a32a818412f1da67b09420bc4cfe559e875cabdf474654f75c608d0605caf59d4bf3c7
-
SSDEEP
393216:qAXGPy7ZibTaBN0N465ODTjSm+EyQ46D0oLazG:hxZzE4vzSNEyQ4E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af5a5919a4dcbb57d4477403b32373569a3394c946eb9d286a0438c371b173f9
Files
-
af5a5919a4dcbb57d4477403b32373569a3394c946eb9d286a0438c371b173f9.exe windows x64
e81509ea25035b4144f6b79db66f0d62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetVersionExW
GetSystemInfo
VirtualQuery
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
SetEnvironmentVariableW
ExitProcess
GetModuleHandleA
RtlAddFunctionTable
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 456B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xcpad Size: - Virtual size: 864KB
.rsrc Size: 382KB - Virtual size: 382KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ