Static task
static1
Behavioral task
behavioral1
Sample
8a8ed31aa05e7e0cceb38fd7e6cc67b184435f0b11b0dad43907f478f74178db.exe
Resource
win7-20230831-en
General
-
Target
8a8ed31aa05e7e0cceb38fd7e6cc67b184435f0b11b0dad43907f478f74178db
-
Size
4.4MB
-
MD5
7deb0edf8f439c84d9abb5ba3b8f555c
-
SHA1
a2d87eeb5391a1dc09aecb1d826f3ffabbaba40d
-
SHA256
8a8ed31aa05e7e0cceb38fd7e6cc67b184435f0b11b0dad43907f478f74178db
-
SHA512
d416ba615ca637609a0623c06ac9b33ee4626fa9f3fab3e980b7da3b7b5b312bdc04eabf9643327dab02793950848ed9d38b3f815d77ce3bdee3a1be24d1a757
-
SSDEEP
49152:JhbwrdPTos6oahrn3rZa0cie3f+LCF5QAELTWglP+zVzmB0Zr5TI80TgdzBoqvMP:JpwrtXqb3FsnBAvWYytvk3eW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a8ed31aa05e7e0cceb38fd7e6cc67b184435f0b11b0dad43907f478f74178db
Files
-
8a8ed31aa05e7e0cceb38fd7e6cc67b184435f0b11b0dad43907f478f74178db.exe windows:6 windows x64
e8cd7e16b793505518348b9d65c0487c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AllocConsole
FindClose
FindFirstFileW
RemoveDirectoryW
DeleteFileW
FindNextFileW
HeapFree
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
VerSetConditionMask
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
VerifyVersionInfoW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryExW
SetLastError
FreeLibrary
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileAttributesW
GetFileSize
SetFilePointer
WriteFile
OutputDebugStringW
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
VirtualQuery
FormatMessageW
GetCurrentDirectoryW
CreateDirectoryW
SetFileAttributesW
LocalAlloc
LocalFree
lstrlenW
WritePrivateProfileStringW
WritePrivateProfileStructW
SleepEx
GetSystemInfo
VirtualProtect
LoadLibraryExA
GetCommandLineW
GlobalFree
GetLongPathNameW
WriteFileEx
SetNamedPipeHandleState
GetOverlappedResult
CancelIo
SetEvent
WaitForSingleObjectEx
CreateEventW
GlobalAlloc
ReadFile
GetEnvironmentVariableW
GetTickCount
LoadLibraryW
GetCurrentThread
ProcessIdToSessionId
OpenProcess
GetExitCodeProcess
CreateProcessW
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
GetFileSizeEx
MapViewOfFile
LocalFileTimeToFileTime
SetFileTime
DosDateTimeToFileTime
FormatMessageA
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
GetTempPathW
AreFileApisANSI
DeviceIoControl
CopyFileW
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
InitOnceBeginInitialize
InitOnceComplete
Sleep
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
RtlPcToFileHeader
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
IsProcessorFeaturePresent
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
IsDebuggerPresent
ResetEvent
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualAlloc
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteConsoleW
ExitProcess
GetCommandLineA
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RaiseFailFastException
GetProcessId
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetUserGeoID
GetGeoInfoW
InitializeCriticalSection
GetSystemDirectoryW
GetWindowsDirectoryW
GetComputerNameW
GetSystemDefaultLocaleName
GetSystemTime
SystemTimeToFileTime
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
GlobalMemoryStatusEx
QueryFullProcessImageNameW
ReleaseSRWLockShared
AcquireSRWLockShared
GlobalFindAtomW
GlobalAddAtomW
MoveFileW
ReplaceFileW
SetFileAttributesA
GetTempFileNameA
CancelIoEx
OpenEventW
RtlUnwind
QueryUnbiasedInterruptTime
ReadDirectoryChangesW
rpcrt4
RpcStringFreeW
UuidCreate
UuidToStringW
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 714KB - Virtual size: 713KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 580KB - Virtual size: 584KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE