Static task
static1
Behavioral task
behavioral1
Sample
4f4d477cd56ea22acf94a4190f2bd28bb553c48e200d2607e92f46f87e3da707.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4f4d477cd56ea22acf94a4190f2bd28bb553c48e200d2607e92f46f87e3da707.exe
Resource
win10v2004-20230915-en
General
-
Target
4f4d477cd56ea22acf94a4190f2bd28bb553c48e200d2607e92f46f87e3da707
-
Size
7.5MB
-
MD5
e976226cd491e7d3f2fbb43169e82595
-
SHA1
f1a42d01a3d1e8ea30e77215e9291d3d54b071d3
-
SHA256
4f4d477cd56ea22acf94a4190f2bd28bb553c48e200d2607e92f46f87e3da707
-
SHA512
db31956168c893f68a7b658cd8974c717bb8dcf08abfe2ad89cf5abc9819dfda9df9995b9bb356de75b5e09e1fca068257fd194e9ffebb4680838d929d591134
-
SSDEEP
196608:hKGd9FfEnPCECJqCHaiZDti71fPsGvHjIaL:hKmnsPCECkC6ip85XsGv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f4d477cd56ea22acf94a4190f2bd28bb553c48e200d2607e92f46f87e3da707
Files
-
4f4d477cd56ea22acf94a4190f2bd28bb553c48e200d2607e92f46f87e3da707.exe windows x86
1cc0fe898310590aacdd6be84e06a6b5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
ws2_32
recvfrom
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableMenuItem
CharUpperBuffW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_GetImageCount
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Sections
T-VMP Size: - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
T-VMP Size: - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
T-VMP Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: 552KB - Virtual size: 551KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ