Static task
static1
Behavioral task
behavioral1
Sample
b8b40bf20019d2f87fffa4e1aeba4e6dca81f02774f951d34c6e3c2e4f7a5e77.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b8b40bf20019d2f87fffa4e1aeba4e6dca81f02774f951d34c6e3c2e4f7a5e77.exe
Resource
win10v2004-20230915-en
General
-
Target
b8b40bf20019d2f87fffa4e1aeba4e6dca81f02774f951d34c6e3c2e4f7a5e77
-
Size
377KB
-
MD5
e7dc3dc205c466f3413a46a2f65d3726
-
SHA1
6ce709e2008a4a51b26a74fe5a617019182b740f
-
SHA256
b8b40bf20019d2f87fffa4e1aeba4e6dca81f02774f951d34c6e3c2e4f7a5e77
-
SHA512
e740a1c43029ceab7a6144f71577d08264a8bcc5b4021cadc16eacd4c84e9d1757d6c07719477a10597d20b5670f12a9ad0921b9592b971b701cfb7624d069b0
-
SSDEEP
6144:W3rj6LeNCqChOIuGRtmvwJECoFjLeSwJECoFjLeX:VSkqChOZGRQvwJEC6jLeSwJEC6jLe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8b40bf20019d2f87fffa4e1aeba4e6dca81f02774f951d34c6e3c2e4f7a5e77
Files
-
b8b40bf20019d2f87fffa4e1aeba4e6dca81f02774f951d34c6e3c2e4f7a5e77.exe windows:5 windows x86
f669e086134239088f1b1940e23fb298
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegisterTraceGuidsW
StartTraceW
TraceEvent
LookupAccountSidA
LookupAccountSidW
OpenTraceW
ProcessTrace
CloseTrace
StopTraceW
kernel32
FindClose
FindNextFileW
FindFirstFileW
SetThreadLocale
GetSystemDefaultLCID
GetConsoleOutputCP
GetThreadLocale
GetUserDefaultUILanguage
LocalFree
WriteFile
WriteConsoleW
GetFileType
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
ReadConsoleW
MultiByteToWideChar
ReadFile
SetConsoleMode
GetConsoleMode
CloseHandle
CreateFileW
SystemTimeToFileTime
FreeLibrary
LoadLibraryW
DeleteFileW
LockResource
LoadResource
FindResourceW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
ExitProcess
GetLastError
GetModuleHandleA
GetACP
GetOEMCP
GetCPInfo
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WideCharToMultiByte
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
RtlUnwind
InterlockedExchange
GetStringTypeA
GetStringTypeW
LoadLibraryA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetLocaleInfoA
RaiseException
SetStdHandle
FlushFileBuffers
SetEndOfFile
Sleep
lstrlenA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetLastError
ExpandEnvironmentStringsW
GetStringTypeExW
GetLocaleInfoW
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
GetProcessHeap
HeapAlloc
HeapFree
GetProcAddress
SetEvent
lstrlenW
GetLocalTime
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
user32
LoadStringW
CharToOemW
wsprintfW
rpcrt4
UuidCreate
ole32
CoCreateInstance
CoInitialize
CoSetProxyBlanket
oleaut32
SafeArrayUnaccessData
VariantClear
SysAllocString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SysFreeString
SafeArrayGetElement
VariantInit
VariantChangeType
SafeArrayDestroy
ntdll
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlFreeUnicodeString
RtlStringFromGUID
RtlEnterCriticalSection
RtlAnsiCharToUnicodeChar
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 230KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE