Static task
static1
Behavioral task
behavioral1
Sample
3010f5727fb04cdb40b1e9c7ac7e313bb9da161c6475417ea415f8093ec8f194.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3010f5727fb04cdb40b1e9c7ac7e313bb9da161c6475417ea415f8093ec8f194.exe
Resource
win10v2004-20230915-en
General
-
Target
3010f5727fb04cdb40b1e9c7ac7e313bb9da161c6475417ea415f8093ec8f194
-
Size
13.2MB
-
MD5
e1a5775e9ebf8c2978ef7e6d5f69ec0f
-
SHA1
eba6e64b202330d30b785f1992d3b4b4ca4d6046
-
SHA256
3010f5727fb04cdb40b1e9c7ac7e313bb9da161c6475417ea415f8093ec8f194
-
SHA512
88628126cb96f0defd5032eff5483fa462d11b98bc753ece66763d4a1729ed56f5742007010e1bc4917d33de95c552d81c4d98800d76cc1a3571b8e08d02f8bb
-
SSDEEP
393216:S5fr/UYDhI7xnpl8jp/z54gtH28Mj+r0zue:Cfr/UYDKlpl8jp/z54guj+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3010f5727fb04cdb40b1e9c7ac7e313bb9da161c6475417ea415f8093ec8f194
Files
-
3010f5727fb04cdb40b1e9c7ac7e313bb9da161c6475417ea415f8093ec8f194.exe windows:5 windows x86
5531587446b4d5c8620a83e07c43dec8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
WindowFromPoint
CharUpperBuffW
gdi32
CreateCompatibleDC
LineTo
gdiplus
GdipGetRegionBounds
ole32
OleInitialize
imm32
ImmGetContext
shell32
ShellExecuteA
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
winmm
PlaySoundA
midiStreamOut
ws2_32
WSAAsyncSelect
rasapi32
RasGetConnectStatusA
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
oleaut32
LoadTypeLi
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
GetSaveFileNameA
Sections
T-VMP Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
T-VMP Size: - Virtual size: 833KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
T-VMP Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
T-VMP Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: 556KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
T-VMP Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ