Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
General
-
Target
file.exe
-
Size
10.0MB
-
MD5
c783ea38348d219ba434831cab84892c
-
SHA1
0e657158c2a8ecd417d6ca2f2943f1fb1f5f771e
-
SHA256
15b1761bf6dcc43ffc1447ff27feac94650ed181a09420dfb3bf398903356bc5
-
SHA512
2ce24b3686a2dff6edd812c7fa86156b88b213b212016f5cdc65524f8be52614bd33df41972e305f5b2575ad8869d0fff7259ba7ed1befdc65c2969cdd5b4c8a
-
SSDEEP
196608:m3ee6nm8ixFvd5URInWOpp9//LDwCnjG/lV2V6igaxnUkNPIDawBuJ:muH4rnWOpHDk6GPkNPbwq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows x86
b05e2410e92b97a4b739f3ded2bca4b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
gdi32
CreateCompatibleBitmap
advapi32
SystemFunction036
shell32
SHGetFolderPathA
ole32
CoUninitialize
ws2_32
WSACleanup
crypt32
CryptUnprotectData
shlwapi
PathFindExtensionA
gdiplus
GdipSaveImageToFile
setupapi
SetupDiEnumDeviceInterfaces
ntdll
RtlUnicodeStringToAnsiString
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ