Static task
static1
Behavioral task
behavioral1
Sample
1b16c8c81b0929e85586dfc1d37523bce669d791187741ac791824871963866f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1b16c8c81b0929e85586dfc1d37523bce669d791187741ac791824871963866f.exe
Resource
win10v2004-20230915-en
General
-
Target
11809106119.zip
-
Size
763KB
-
MD5
19571ce5367922025675418b4f083a9e
-
SHA1
ab12895028334d0ba60fbd87df88d2be27e04c7d
-
SHA256
f92f4475ace648fb45d69b13a71461ade07a1d68e75f552894a145b92425d72e
-
SHA512
9cffd11817acdb10d5342658d72868712d7e2583649da6da8222f2ffddda0ce4ba9c254e5a084a56af5cbae41825c568b252f055728d633351cd32928a85e4e3
-
SSDEEP
12288:HhZgw2/VVwhQXETnigYvdkQn66CYj16EXlcp1KCZYnN8gBnIGELDaQVF2jhTVAFj:HhZJ2CQXEjzYWQnz3j16EXC3+nPSPDaY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1b16c8c81b0929e85586dfc1d37523bce669d791187741ac791824871963866f
Files
-
11809106119.zip.zip
Password: infected
-
1b16c8c81b0929e85586dfc1d37523bce669d791187741ac791824871963866f.exe windows x86
dddd6c6dc7cae74f9ce31daf21f95f24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
kernel32
HeapFree
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
GetProcessHeap
HeapAlloc
HeapReAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
SwitchToThread
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
WaitForSingleObject
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WriteConsoleW
SetLastError
GetEnvironmentVariableW
CreateFileW
GetFullPathNameW
GetModuleHandleW
FormatMessageW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
SleepEx
ReadFileEx
WriteFileEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
SetHandleInformation
PostQueuedCompletionStatus
SetFilePointerEx
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
DecodePointer
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
ntdll
RtlNtStatusToDosError
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
ws2_32
bind
getpeername
WSAGetLastError
getsockname
shutdown
WSASend
send
recv
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
getsockopt
connect
setsockopt
WSAIoctl
ioctlsocket
WSASocketW
closesocket
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom
Sections
.text Size: 868KB - Virtual size: 868KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ