Static task
static1
Behavioral task
behavioral1
Sample
224890a9aaefa7e9a1a230abe790ade0accd472728c1950d3d1f48ddc00f04b3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
224890a9aaefa7e9a1a230abe790ade0accd472728c1950d3d1f48ddc00f04b3.exe
Resource
win10v2004-20230915-en
General
-
Target
224890a9aaefa7e9a1a230abe790ade0accd472728c1950d3d1f48ddc00f04b3
-
Size
13.1MB
-
MD5
6011e60219afee5a1c4810090b4099df
-
SHA1
ab7078f9073f6ace08270b8cc12f0f306a8a1f69
-
SHA256
224890a9aaefa7e9a1a230abe790ade0accd472728c1950d3d1f48ddc00f04b3
-
SHA512
d5fc855319be04e7b2ca1ae11cd2558e369ba1dd5f30cda6c070935dcce581e2be5e95f22aed5b0a1fc19b489751f52bae34d0443ffc59904d80c913f5d494c8
-
SSDEEP
393216:+oRsETmRgTMpcQQ1a1SzE0B8VXAjaN3LvJGJn6:+aREgTMpcQQ1aEz/Bn+N3Vsn6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 224890a9aaefa7e9a1a230abe790ade0accd472728c1950d3d1f48ddc00f04b3
Files
-
224890a9aaefa7e9a1a230abe790ade0accd472728c1950d3d1f48ddc00f04b3.exe windows:5 windows x86
12b4a63374abb54a295a0183ac8adbfd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetActiveWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
LineTo
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
DragQueryFileA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Add
wininet
InternetCloseHandle
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.xilou Size: - Virtual size: 689KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xilou Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xilou Size: - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xilou Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xilou Size: - Virtual size: 24B
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xilou Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xilou Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xilou Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xilou Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE