Static task
static1
Behavioral task
behavioral1
Sample
aade005e317fef7e33c5633d0efdee359a2292b128b2abc21e64435531f2f220.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aade005e317fef7e33c5633d0efdee359a2292b128b2abc21e64435531f2f220.exe
Resource
win10v2004-20230915-en
General
-
Target
aade005e317fef7e33c5633d0efdee359a2292b128b2abc21e64435531f2f220
-
Size
959KB
-
MD5
186bc6c018db99d2b6abe732e900b9fd
-
SHA1
b4f8710ae455f503495900738f12e5483cfc14a5
-
SHA256
aade005e317fef7e33c5633d0efdee359a2292b128b2abc21e64435531f2f220
-
SHA512
bfe0f3f1bb990142db29948f755461073846f65f9ef3bddd3ead5d25c0bc78e61bb945203f1b185de300df79b04dd4d90a3363c10e0a149ddd77d5b8f13786fc
-
SSDEEP
24576:FHooLG0lBQTVTLiVNN0bRTVEKIC6weQ+DCvcJU:FIEG0lBQTVfNTVEKIC6weQ+DCkJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aade005e317fef7e33c5633d0efdee359a2292b128b2abc21e64435531f2f220
Files
-
aade005e317fef7e33c5633d0efdee359a2292b128b2abc21e64435531f2f220.exe windows:6 windows x64
6402747fb6652d8165d894f266d0ea46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
memmove
strcmp
wcslen
memcmp
memset
strncmp
strlen
strcpy
strcat
strstr
strrchr
__chkstk
memcpy
kernel32
GetCurrentThread
GetPriorityClass
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32FirstW
Module32NextW
GetCurrentProcess
GetLastError
GetTickCount64
GetCurrentThreadId
Sleep
GetCurrentProcessId
gdi32
CreatePen
GetDIBits
GetDeviceCaps
TextOutW
MoveToEx
SetTextColor
StretchDIBits
SetBkMode
SetBkColor
SelectObject
Rectangle
LineTo
DeleteObject
DeleteDC
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateSolidBrush
Sections
.text Size: 398KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 272KB - Virtual size: 271KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ