Static task
static1
Behavioral task
behavioral1
Sample
1f2822d427c638308ceb22f10f9300c2fa6984d3785fe86bd70201004ade0f3c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1f2822d427c638308ceb22f10f9300c2fa6984d3785fe86bd70201004ade0f3c.exe
Resource
win10v2004-20230915-en
General
-
Target
1f2822d427c638308ceb22f10f9300c2fa6984d3785fe86bd70201004ade0f3c
-
Size
113KB
-
MD5
21fc4ec907a8617e9ba9ece325f95f77
-
SHA1
f858b56fb6b79ed78ba12205cf98a248deedd0de
-
SHA256
1f2822d427c638308ceb22f10f9300c2fa6984d3785fe86bd70201004ade0f3c
-
SHA512
1ebc4fb8ca9e743718c675807fb0c4a6095be6abb47a6efb5b9c7ee61820ad21b3f1840f8e15a943db76b92c43448c8b909c6b0919799a78a2236072d395e227
-
SSDEEP
768:f0guc+B6q5H9f8xHr8sSnYzLuzZLE7lTSxqkcqN6dB5:fvJq5dyinYzLud2lTSyJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f2822d427c638308ceb22f10f9300c2fa6984d3785fe86bd70201004ade0f3c
Files
-
1f2822d427c638308ceb22f10f9300c2fa6984d3785fe86bd70201004ade0f3c.exe windows:4 windows x86
bb149409ff1b65d24cbc6eaee5a30672
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
IsBadReadPtr
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
lstrlenA
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
_wcsnicmp
abort
bsearch
calloc
exit
fclose
fopen
fprintf
free
fwrite
malloc
mbstowcs
memcpy
memset
qsort
realloc
signal
sprintf
strcmp
strlen
strncmp
strstr
strtol
strtoul
vfprintf
wcstombs
ws2_32
WSACleanup
WSAStartup
closesocket
connect
gethostbyname
htons
recv
send
socket
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1008B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/31 Size: 512B - Virtual size: 303B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/45 Size: 1024B - Virtual size: 552B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/57 Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ