Static task
static1
Behavioral task
behavioral1
Sample
8b6e72c3a1c183c242612703b08ae463f31088d3afcd5a338e6e1176d8d7f1cb.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8b6e72c3a1c183c242612703b08ae463f31088d3afcd5a338e6e1176d8d7f1cb.exe
Resource
win10v2004-20230915-en
General
-
Target
8b6e72c3a1c183c242612703b08ae463f31088d3afcd5a338e6e1176d8d7f1cb
-
Size
11.8MB
-
MD5
5aa049a89ed41d07e47af29e29d089ed
-
SHA1
4d2c140103df2c0a9aa80b92b578495c6cf2f8ea
-
SHA256
8b6e72c3a1c183c242612703b08ae463f31088d3afcd5a338e6e1176d8d7f1cb
-
SHA512
69c87df1ff32825d572cd510a680b6b60f4bdacea2f2badb9cbc9fe7d8a42391770c969241ede35569ac8460794af815c7d5c6dd5cbdd2929d519175fd2480fa
-
SSDEEP
196608:dCGC84qseeDm+y4HOqGAwgpW5TkIMorJYBLc8q5mV2KUxFYfo7nIefr:swse6y4Hq/gmhZYRc3mV2KUxFYQ7I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8b6e72c3a1c183c242612703b08ae463f31088d3afcd5a338e6e1176d8d7f1cb
Files
-
8b6e72c3a1c183c242612703b08ae463f31088d3afcd5a338e6e1176d8d7f1cb.exe windows:6 windows x64
706f9ea45d2be952af6cc3e8fcf0f7a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlUnwindEx
dbghelp
SymCleanup
ws2_32
inet_ntoa
kernel32
GetVersionExW
GetVersion
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyboardLayout
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateBitmap
msimg32
TransparentBlt
comdlg32
CommDlgExtendedError
winspool.drv
ClosePrinter
advapi32
RegQueryValueW
shell32
SHGetFileInfoW
comctl32
_TrackMouseEvent
shlwapi
PathIsDirectoryW
uxtheme
OpenThemeData
ole32
CoTaskMemAlloc
oleaut32
LoadTypeLi
oledlg
OleUIBusyW
gdiplus
GdipCreateBitmapFromHBITMAP
odbc32
ord2
crypt32
CryptProtectData
fltlib
FilterConnectCommunicationPort
rpcrt4
NdrServerCall2
wintrust
CryptCATAdminReleaseContext
version
VerQueryValueW
oleacc
CreateStdAccessibleObject
imm32
ImmGetContext
winmm
PlaySoundW
wldap32
ord30
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.giats Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.py0 Size: - Virtual size: 18.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.py1 Size: 11.7MB - Virtual size: 11.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ