Static task
static1
Behavioral task
behavioral1
Sample
8208297521d4e7a3200e3a97f197f6b1224258a2f30d2123040ec5b56519cbf2.exe
Resource
win7-20230831-en
General
-
Target
8208297521d4e7a3200e3a97f197f6b1224258a2f30d2123040ec5b56519cbf2
-
Size
1.6MB
-
MD5
25fab9b9c5fcd2fdae14638e7b4c7dc0
-
SHA1
2f7ae209dc6b7d12fde64a93e48f41ab2c1b93b3
-
SHA256
8208297521d4e7a3200e3a97f197f6b1224258a2f30d2123040ec5b56519cbf2
-
SHA512
daa32c3988748f292a156897d2ff126e01d06f07fd8daa098a8c27d79f2d6f2dda1008f7dcc920d032102a0db023f20f4cbec426ced92dd411c567d3a18cdab9
-
SSDEEP
12288:bHYqq2pcfKTVLK44Nvr+qf3afusbUz0XYvs5HECwW90sSkssgAZLMsjmGm0ihSuo:bHQKTVgZr+qfck2Yk5bKdAubhSu+PVx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8208297521d4e7a3200e3a97f197f6b1224258a2f30d2123040ec5b56519cbf2
Files
-
8208297521d4e7a3200e3a97f197f6b1224258a2f30d2123040ec5b56519cbf2.exe windows:6 windows x86
6f72dcf847a5f386d43cb44c0caeca7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
shlwapi
PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW
StrStrIW
PathFindFileNameW
kernel32
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
DeleteFileW
GetModuleFileNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetFileAttributesW
Sleep
GetCurrentProcess
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileAttributesExW
FindFirstFileW
ReadFile
DeviceIoControl
GetTickCount
WriteFile
SetFilePointer
RemoveDirectoryW
FindNextFileW
FindClose
InitializeCriticalSectionAndSpinCount
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
GetVersion
GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ExpandEnvironmentStringsW
GetLongPathNameW
GetLocalTime
CreateDirectoryW
LoadLibraryW
SetFileAttributesW
FreeLibrary
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
MoveFileExW
CopyFileW
VirtualAlloc
VirtualFree
MoveFileW
OutputDebugStringW
IsDebuggerPresent
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
DecodePointer
WriteConsoleW
GetProcAddress
GetModuleHandleW
GetLastError
RaiseException
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetFileType
GetStringTypeW
EncodePointer
QueryPerformanceCounter
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetACP
advapi32
RegCreateKeyExW
RegDeleteKeyW
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE