Static task
static1
Behavioral task
behavioral1
Sample
8415d4a1600682951a7938dc4060536e0921b68a093dc9f6af815368c3d77604.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8415d4a1600682951a7938dc4060536e0921b68a093dc9f6af815368c3d77604.exe
Resource
win10v2004-20230915-en
General
-
Target
8415d4a1600682951a7938dc4060536e0921b68a093dc9f6af815368c3d77604
-
Size
10.1MB
-
MD5
0d57dfa570972df511e2a5e1f78be033
-
SHA1
dc99e56dfef3d9d45bd95af4dfbb568bd3d1c488
-
SHA256
8415d4a1600682951a7938dc4060536e0921b68a093dc9f6af815368c3d77604
-
SHA512
30552d9aefc341ad93df41bf80a97a18aea03d1660e80867fdee997e0af8b8f4747800f6d6340bcdaf9dcf3896ecc384d402ad9f12abe2b66d870ae2a2eb3717
-
SSDEEP
3072:1L0J4xQDeqnTIXiWxCAUVp5zd+lZEkjH3uw:1LZQLnT1K7OpJdqzHl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8415d4a1600682951a7938dc4060536e0921b68a093dc9f6af815368c3d77604
Files
-
8415d4a1600682951a7938dc4060536e0921b68a093dc9f6af815368c3d77604.exe windows:6 windows x64
6650b206d50c0f3bc0fe2e0e652019d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
SetProcessAffinityMask
LoadLibraryA
IsBadReadPtr
Sleep
CloseHandle
GetLastError
SetErrorMode
SetEvent
CreateEventA
OpenEventA
GetCurrentThreadId
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
CreateFileMappingA
OpenFileMappingA
FreeLibrary
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
LCMapStringEx
GetTickCount
GetSystemInfo
GetCurrentProcess
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetStdHandle
WriteFile
GetModuleFileNameW
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
HeapSize
SetLastError
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetStartupInfoW
GetModuleHandleW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
OutputDebugStringW
LoadLibraryExW
LoadLibraryW
CreateFileW
user32
PeekMessageA
LoadCursorA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
GetWindowThreadProcessId
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
PostMessageA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageW
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ