Static task
static1
Behavioral task
behavioral1
Sample
d9eef361eec959418fe8203062ea65963cccf7c54dc29222631ab6d17c4e794d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d9eef361eec959418fe8203062ea65963cccf7c54dc29222631ab6d17c4e794d.exe
Resource
win10v2004-20230915-en
General
-
Target
d9eef361eec959418fe8203062ea65963cccf7c54dc29222631ab6d17c4e794d
-
Size
5.6MB
-
MD5
1857d0402a0c588575f861cabc790fca
-
SHA1
8ffd95eae6527261857d667e6299160c253c0637
-
SHA256
d9eef361eec959418fe8203062ea65963cccf7c54dc29222631ab6d17c4e794d
-
SHA512
6800bd0bc1d63931d51c7e2fda40181aab14e9c9c6ef2192a248b0850d7d225d97a2e7a1df6f0176f3142400e0899a537f6e52e35ddeac46d7a617198e251ff6
-
SSDEEP
98304:HQm7qUZDV7TNvg7THFjy7BhSa0ZGk4EtMB9YoLVoRDjCAs467o3J4mUJgcz9f6:HQm/ZDtZmBeDCMc65ksv8uxy2i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9eef361eec959418fe8203062ea65963cccf7c54dc29222631ab6d17c4e794d
Files
-
d9eef361eec959418fe8203062ea65963cccf7c54dc29222631ab6d17c4e794d.exe windows x86
3d3ed15885521e51e5e5c1a59a155d59
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
version
VerLanguageNameA
kernel32
GetSystemDirectoryA
user32
GetActiveWindow
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 4.3MB - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ