Static task
static1
Behavioral task
behavioral1
Sample
d3f9638059dc39c299ce90f5677fbb158711d31c984ad810e9f49739444ba363.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d3f9638059dc39c299ce90f5677fbb158711d31c984ad810e9f49739444ba363.exe
Resource
win10v2004-20230915-en
General
-
Target
d3f9638059dc39c299ce90f5677fbb158711d31c984ad810e9f49739444ba363
-
Size
938KB
-
MD5
25f4cb3e8ebc2b908f44d593aff400d4
-
SHA1
29eec9be21b1fb41e2eb43dbb0ac941f92732772
-
SHA256
d3f9638059dc39c299ce90f5677fbb158711d31c984ad810e9f49739444ba363
-
SHA512
88bb89176e4ed0e9eb43d781b7fa12257ccf804e0f245038799ca9176069c30a8988bac96d37d1d097089f0c405aeac21ca441de4e7b38b913a8501d7e2550e0
-
SSDEEP
24576:xwpYK+0BIJfYL2kWsd//EXKsSfPNeu51hrU6z2aKr:xwpYSBbL2kbdXEXKsSfPNrJrUM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3f9638059dc39c299ce90f5677fbb158711d31c984ad810e9f49739444ba363
Files
-
d3f9638059dc39c299ce90f5677fbb158711d31c984ad810e9f49739444ba363.exe windows x64
54bab295822b7dc28fa3810066687384
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memmove
strcmp
wcslen
memcmp
memset
strncmp
strlen
strcpy
strcat
strstr
strrchr
__chkstk
memcpy
kernel32
GetCurrentProcess
GetCurrentThread
GetPriorityClass
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcessId
MultiByteToWideChar
GetLastError
GetCurrentThreadId
Sleep
GetTickCount64
gdi32
CreatePen
GetDIBits
GetDeviceCaps
TextOutW
MoveToEx
SetTextColor
StretchDIBits
SetBkMode
SetBkColor
SelectObject
Rectangle
LineTo
DeleteObject
DeleteDC
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateSolidBrush
Sections
.text Size: 394KB - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 276KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 231KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ