Static task
static1
Behavioral task
behavioral1
Sample
2fd5abc6cd500dda6b5bb241fc3a5c39505eddab11ca45539153873650b71402.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2fd5abc6cd500dda6b5bb241fc3a5c39505eddab11ca45539153873650b71402.exe
Resource
win10v2004-20230915-en
General
-
Target
2fd5abc6cd500dda6b5bb241fc3a5c39505eddab11ca45539153873650b71402
-
Size
4.8MB
-
MD5
5716616bd82218c84d7c7883e404c7d7
-
SHA1
4b2132178fa6e195a31446d63f500a7ee2d0cb74
-
SHA256
2fd5abc6cd500dda6b5bb241fc3a5c39505eddab11ca45539153873650b71402
-
SHA512
ce75da1063f922f91d2ef089d25f2240e8cfe908303571095889582fcd96d3fde329112f23a96f1720d9d4d5112bb6011a1c1d9611934616bff4ac888c90aa67
-
SSDEEP
98304:2cR+zEDA/Fd72h7NrwjCyO6dTJ0OclWB47TA0qCwph+v9Suk:6g4KcjFhJwlH3cz20
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2fd5abc6cd500dda6b5bb241fc3a5c39505eddab11ca45539153873650b71402
Files
-
2fd5abc6cd500dda6b5bb241fc3a5c39505eddab11ca45539153873650b71402.exe windows x86
49b1a53532e739bdea64f239918349aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushConsoleInputBuffer
GetSystemTime
ReadConsoleInputA
SetConsoleMode
GlobalMemoryStatus
FreeLibrary
GetProcAddress
SystemTimeToFileTime
DecodePointer
HeapSize
GetTimeZoneInformation
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetFileAttributesExA
Sleep
SleepEx
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
GetTickCount
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsA
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetLastError
FormatMessageA
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
GetStringTypeW
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wldap32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217
ws2_32
recv
WSASetLastError
getaddrinfo
__WSAFDIsSet
socket
bind
freeaddrinfo
accept
listen
recvfrom
sendto
send
closesocket
connect
getservbyname
gethostbyname
htonl
shutdown
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSAGetLastError
WSACleanup
gethostname
ioctlsocket
select
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
advapi32
CryptGetUserKey
RegisterEventSourceA
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101.2MB - Virtual size: 101.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ