Static task
static1
Behavioral task
behavioral1
Sample
2c4a29badec41d7b524ef634e9c2a3c08f6e4652d19cad5a7ccedba0e1f002b0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2c4a29badec41d7b524ef634e9c2a3c08f6e4652d19cad5a7ccedba0e1f002b0.exe
Resource
win10v2004-20230915-en
General
-
Target
2c4a29badec41d7b524ef634e9c2a3c08f6e4652d19cad5a7ccedba0e1f002b0
-
Size
4.8MB
-
MD5
acc7cda346aef6bc487d12232a5bedb2
-
SHA1
a43112e907dffa8cd13cc8b96c4608892f481e96
-
SHA256
2c4a29badec41d7b524ef634e9c2a3c08f6e4652d19cad5a7ccedba0e1f002b0
-
SHA512
1d03b5f1d1d79d6b5c464e6e1331760644cf4ecc92acd535f20d68343dbaee5952a78af3c1d12801693cce8cb2c1bf5d0c9479698367232e274549a97f7921c7
-
SSDEEP
98304:2cR+zEDA/Fd72h7NrwjCyO6dTJ0OclWB47TA0qCwph+v9Sui:6g4KcjFhJwlH3cz2y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c4a29badec41d7b524ef634e9c2a3c08f6e4652d19cad5a7ccedba0e1f002b0
Files
-
2c4a29badec41d7b524ef634e9c2a3c08f6e4652d19cad5a7ccedba0e1f002b0.exe windows x86
49b1a53532e739bdea64f239918349aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushConsoleInputBuffer
GetSystemTime
ReadConsoleInputA
SetConsoleMode
GlobalMemoryStatus
FreeLibrary
GetProcAddress
SystemTimeToFileTime
DecodePointer
HeapSize
GetTimeZoneInformation
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetFileAttributesExA
Sleep
SleepEx
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
GetTickCount
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsA
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetLastError
FormatMessageA
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
GetStringTypeW
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wldap32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217
ws2_32
recv
WSASetLastError
getaddrinfo
__WSAFDIsSet
socket
bind
freeaddrinfo
accept
listen
recvfrom
sendto
send
closesocket
connect
getservbyname
gethostbyname
htonl
shutdown
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSAGetLastError
WSACleanup
gethostname
ioctlsocket
select
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
advapi32
CryptGetUserKey
RegisterEventSourceA
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101.2MB - Virtual size: 101.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ