Static task
static1
Behavioral task
behavioral1
Sample
0a611eb4a9a7f6d36904659a9cac5f4e3a7c42638536be575e91196a6b1df21d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0a611eb4a9a7f6d36904659a9cac5f4e3a7c42638536be575e91196a6b1df21d.exe
Resource
win10v2004-20230915-en
General
-
Target
0a611eb4a9a7f6d36904659a9cac5f4e3a7c42638536be575e91196a6b1df21d
-
Size
152KB
-
MD5
efb2040565eb639ab5c9f42c6d2ab746
-
SHA1
efb19c0e33882fadaa535646e8aa5c15fb0a7939
-
SHA256
0a611eb4a9a7f6d36904659a9cac5f4e3a7c42638536be575e91196a6b1df21d
-
SHA512
a89b20db37c424ed35974bb318ed16139f0b5bf14ddba842f95ad4829139d3cd885d5d4f3a00c93c1f4336f6f2e1c6738f3b6d81e3062cfba3e8a8e18349174a
-
SSDEEP
1536:okF9Ht5Mx1cCY5oWDLukHToQ3Cxp2mLNkIeMElS9ryWzNllIlf9mxi2iLBSPlv:j9NsLqoyurHZhEItyWzNllAwxKSPl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a611eb4a9a7f6d36904659a9cac5f4e3a7c42638536be575e91196a6b1df21d
Files
-
0a611eb4a9a7f6d36904659a9cac5f4e3a7c42638536be575e91196a6b1df21d.exe windows:4 windows x86
63a0bc967ef28ea0b0449b904f14ae2b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscms
InstallColorProfileA
GetColorDirectoryA
ddraw
DirectDrawCreateEx
gdi32
GetDeviceGammaRamp
SetDeviceGammaRamp
kernel32
lstrcpyW
LoadLibraryW
GetCurrentThread
LeaveCriticalSection
GetProcAddress
lstrcatW
GetCurrentProcess
CreateEventW
lstrcpynW
GetSystemDirectoryA
DeleteFileA
TerminateProcess
_lclose
_hwrite
_lcreat
LockResource
FindResourceW
LoadResource
LoadLibraryExW
lstrlenA
MultiByteToWideChar
FreeLibrary
GetModuleHandleW
GetShortPathNameW
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
lstrlenW
GetCommandLineW
lstrcmpiW
CreateMutexW
GetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
CopyFileA
CreateFileA
ReadFile
SetFilePointer
CloseHandle
SizeofResource
EnterCriticalSection
CreateProcessA
WaitForSingleObject
TlsSetValue
TlsAlloc
RaiseException
FlushFileBuffers
GetCPInfo
LCMapStringA
GetStringTypeW
LCMapStringW
GetStringTypeA
LoadLibraryA
IsBadCodePtr
GetOEMCP
GetACP
GetModuleFileNameA
GetEnvironmentVariableA
SetUnhandledExceptionFilter
WideCharToMultiByte
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
IsBadReadPtr
SetStdHandle
SetLastError
TlsGetValue
IsBadWritePtr
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetEnvironmentStrings
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
user32
GetDC
PostThreadMessageW
CharNextW
LoadStringW
DispatchMessageW
GetMessageW
FindWindowW
MessageBoxW
SendMessageW
advapi32
RegEnumValueW
SetSecurityDescriptorDacl
RegDeleteKeyW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
StartServiceCtrlDispatcherW
OpenSCManagerW
ControlService
DeleteService
CreateServiceW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
SetServiceStatus
RegisterServiceCtrlHandlerW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenServiceW
CloseServiceHandle
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
OpenProcessToken
OpenThreadToken
GetTokenInformation
RegDeleteValueA
RegCreateKeyW
ole32
CoTaskMemRealloc
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr
Sections
.text Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE