CreateInterface
Static task
static1
Behavioral task
behavioral1
Sample
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1.exe
Resource
win10v2004-20230915-en
General
-
Target
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1
-
Size
1.7MB
-
MD5
75daf33cf6978d298442b033a0b29fc2
-
SHA1
8c24586e9325afd175eff0414af26f52a304e54b
-
SHA256
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1
-
SHA512
4ab02047169f512aed0d59b87bc41dabb57cea9bf0fdfecdba60826b22e844f1fd3168dfaa55bc884c7f5fd878ba4343b42e0b888c19b73e8d6659f08b2f0640
-
SSDEEP
12288:I/BCWHrJveuseTKA9u7WoNfct4B4Hcl8SxzR6SQto8Jn:K51eA6WoNfo4Ghq6SQtoEn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1
Files
-
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1.exe windows x86
fe8ffd25d9017ca44a3e91b00462318b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlUnwind
NtTerminateProcess
NtSetInformationProcess
RtlImageNtHeader
kernel32
GetCurrentThreadId
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadLibraryA
GetCommandLineA
GetCurrentProcess
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
ExitProcess
TerminateProcess
GetModuleHandleA
IsDebuggerPresent
LocalFree
FormatMessageA
IsBadReadPtr
GetLongPathNameA
GetModuleFileNameA
SetStdHandle
GetProcessHeap
GetLastError
CreateFileW
HeapSize
SetEndOfFile
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
WriteConsoleW
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
user32
wsprintfA
MessageBoxA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
ws2_32
WSAStartup
WSACleanup
Exports
Exports
Sections
.text Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ