Static task
static1
Behavioral task
behavioral1
Sample
266e110e7860d9d45f5fba3a5c4f819613233235dad1b1791e2b762db5faafa7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
266e110e7860d9d45f5fba3a5c4f819613233235dad1b1791e2b762db5faafa7.exe
Resource
win10v2004-20230915-en
General
-
Target
266e110e7860d9d45f5fba3a5c4f819613233235dad1b1791e2b762db5faafa7
-
Size
351KB
-
MD5
bfaf10aec7e6f2830dc5876e50eae11a
-
SHA1
ed9ab54a9740788cc5a826ca5466169b6147bd51
-
SHA256
266e110e7860d9d45f5fba3a5c4f819613233235dad1b1791e2b762db5faafa7
-
SHA512
ababf3fe1c892386b14b1b0dd48c4a749eb1b1189537d6d76e6629dad4c7f34a3d6379ef47aee58804fb450537e585b25efb4cf8897f4202ff265e070aa4b28e
-
SSDEEP
6144:Qm794hSxhMUt23ISdP6p3EQT/6b17Gruz5oU+:/9sSxhMUI3ISdPk/iAuz5Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 266e110e7860d9d45f5fba3a5c4f819613233235dad1b1791e2b762db5faafa7
Files
-
266e110e7860d9d45f5fba3a5c4f819613233235dad1b1791e2b762db5faafa7.exe windows x86
ea1dfbd2adbf6c3260bf3c323b4b4b5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetCurrentProcess
GetExitCodeProcess
GetVersionExA
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FindResourceExW
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
CopyFileA
WideCharToMultiByte
GetProcessHeap
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
SetEndOfFile
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetConsoleCtrlHandler
HeapSize
HeapFree
HeapAlloc
HeapReAlloc
HeapDestroy
CloseHandle
DecodePointer
GetCurrentDirectoryA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetCurrentThread
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
WriteConsoleW
user32
MessageBoxA
GetClientRect
EndPaint
UnregisterClassA
DrawTextA
DestroyWindow
PostQuitMessage
DefWindowProcA
ExitWindowsEx
BeginPaint
gdi32
SetBkMode
SetBkColor
ExtTextOutA
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
shell32
ShellExecuteExA
SHGetFolderPathA
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ