Static task
static1
Behavioral task
behavioral1
Sample
6e4b2489bfea42138fa8464f910d08012e57e0659f25243ec544e2c07a3e58b3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6e4b2489bfea42138fa8464f910d08012e57e0659f25243ec544e2c07a3e58b3.exe
Resource
win10v2004-20230915-en
General
-
Target
e22141ffc74538428d08e671e99b32e7.bin
-
Size
22KB
-
MD5
8b8523202ce9187fa572ae834e00f979
-
SHA1
6ef17b650ecd68848c63aef8561acbedf1f616ed
-
SHA256
3f5591af757218018788d8f1323fe129e3323b528ff91d0e152dcabc8b3ce949
-
SHA512
36b55dddd4538a79b9c62451082b2621b2a71bebf483c65eca7f3d3016bd2b211ba9ca714d4ed7ea65bea5f5f3bca484e9c9bba679f2b2036991ed8971c82583
-
SSDEEP
384:Ctry1czouWL11M/JsyXHuhiON6twKie5fsk0eh61hrqo2cD0nMmktFYal:fi81cu0O2wvEfsk0gerqonHNR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6e4b2489bfea42138fa8464f910d08012e57e0659f25243ec544e2c07a3e58b3.exe
Files
-
e22141ffc74538428d08e671e99b32e7.bin.zip
Password: infected
-
6e4b2489bfea42138fa8464f910d08012e57e0659f25243ec544e2c07a3e58b3.exe.exe windows:4 windows x86
Password: infected
65d4de9971e542941b35f36d46916526
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
SetTimer
GetMessageA
DispatchMessageA
KillTimer
hb627
HB627_Open
HB627_Close
HB627_Read_Channel
kernel32
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetConsoleCP
GetNumberOfConsoleInputEvents
PeekConsoleInputA
CreateFileA
MultiByteToWideChar
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleA
RtlUnwind
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
ExitProcess
GetSystemTimeAsFileTime
GetStartupInfoA
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetConsoleCtrlHandler
WriteFile
GetLastError
ReadFile
VirtualAlloc
VirtualQuery
CloseHandle
SetFilePointer
SetStdHandle
DeleteFileA
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE