Static task
static1
Behavioral task
behavioral1
Sample
77aba65ee373adcda3b1207a05d26f6ed202cb44a970ffd2c7a6b2b759de77cb.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
77aba65ee373adcda3b1207a05d26f6ed202cb44a970ffd2c7a6b2b759de77cb.exe
Resource
win10v2004-20230915-en
General
-
Target
77aba65ee373adcda3b1207a05d26f6ed202cb44a970ffd2c7a6b2b759de77cb
-
Size
4.8MB
-
MD5
c071288b28e8d615256905f516d48ac4
-
SHA1
d310a26407140d46e27d50b8bd696e03ebb93563
-
SHA256
77aba65ee373adcda3b1207a05d26f6ed202cb44a970ffd2c7a6b2b759de77cb
-
SHA512
4c5b3b406ae11160d6310c0285660a0a1fe581b699ab50010cd49dd179fcbcf8c92feb86eacac6169e28d30d5da2274925a34f9491bfc259905688d83b305de7
-
SSDEEP
98304:2cR+zEDA/Fd72h7NrwjCyO6dTJ0OclWB47TA0qCwph+v9Su5:6g4KcjFhJwlH3cz2p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77aba65ee373adcda3b1207a05d26f6ed202cb44a970ffd2c7a6b2b759de77cb
Files
-
77aba65ee373adcda3b1207a05d26f6ed202cb44a970ffd2c7a6b2b759de77cb.exe windows x86
49b1a53532e739bdea64f239918349aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushConsoleInputBuffer
GetSystemTime
ReadConsoleInputA
SetConsoleMode
GlobalMemoryStatus
FreeLibrary
GetProcAddress
SystemTimeToFileTime
DecodePointer
HeapSize
GetTimeZoneInformation
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetFileAttributesExA
Sleep
SleepEx
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
GetTickCount
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsA
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetLastError
FormatMessageA
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
GetStringTypeW
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wldap32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217
ws2_32
recv
WSASetLastError
getaddrinfo
__WSAFDIsSet
socket
bind
freeaddrinfo
accept
listen
recvfrom
sendto
send
closesocket
connect
getservbyname
gethostbyname
htonl
shutdown
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSAGetLastError
WSACleanup
gethostname
ioctlsocket
select
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
advapi32
CryptGetUserKey
RegisterEventSourceA
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101.2MB - Virtual size: 101.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ