Static task
static1
Behavioral task
behavioral1
Sample
09b1f1366a87a748b11d50cb3c6ba00f03890a264c8fc3ca6c69e358a82d937b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
09b1f1366a87a748b11d50cb3c6ba00f03890a264c8fc3ca6c69e358a82d937b.exe
Resource
win10v2004-20230915-en
General
-
Target
09b1f1366a87a748b11d50cb3c6ba00f03890a264c8fc3ca6c69e358a82d937b
-
Size
1.5MB
-
MD5
b43f1fe5667b501adc549be41718dd00
-
SHA1
d2d90fd11043b3cfc13df87638f88a1d8bdfe7ac
-
SHA256
09b1f1366a87a748b11d50cb3c6ba00f03890a264c8fc3ca6c69e358a82d937b
-
SHA512
05d15002709d201b79fc104564429d3d7e8b192d1915c849af4c8cf470f834846a78d3bb7659c9afa03b38f8b8fc2c0d3d08bbc541b13422fffbda0fa4cf3cb4
-
SSDEEP
49152:spHaD0UDcXayKwE2ee2G9TmEVs8lLCt7EE/6t:YHe8XaNo2GVmosKLsVM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09b1f1366a87a748b11d50cb3c6ba00f03890a264c8fc3ca6c69e358a82d937b
Files
-
09b1f1366a87a748b11d50cb3c6ba00f03890a264c8fc3ca6c69e358a82d937b.exe windows:4 windows x86
bda0475f8920d979043ac0624aceecaf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
SetCurrentDirectoryA
user32
GetCursorPos
gdi32
RestoreDC
winmm
waveOutRestart
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
inet_ntoa
wininet
HttpQueryInfoA
comdlg32
GetSaveFileNameA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 560KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 976KB - Virtual size: 976KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ