Static task
static1
Behavioral task
behavioral1
Sample
fda9b91ed671cc75b8adca1afa6e6f37cea7155d15ebef8f37d2d05d643699dc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fda9b91ed671cc75b8adca1afa6e6f37cea7155d15ebef8f37d2d05d643699dc.exe
Resource
win10v2004-20230915-en
General
-
Target
fda9b91ed671cc75b8adca1afa6e6f37cea7155d15ebef8f37d2d05d643699dc
-
Size
11.5MB
-
MD5
aa0d30142d8ce4208e6588eac3d1c0a1
-
SHA1
e0cc6b933fa9ff4ab8ea36f76fec8cd6c31ae9f0
-
SHA256
fda9b91ed671cc75b8adca1afa6e6f37cea7155d15ebef8f37d2d05d643699dc
-
SHA512
6be3f74072584ec982efa399875fde764c5ddbc93b22650854cf6dc1b3a35816e288c480a8199c01742314e0010cf7b3177954754f827b7533591abcaeb06880
-
SSDEEP
98304:pHeUsNvBu0u0u0u0u0u0u0u0u0u0u0u0u:p+MVVVVVVVVVVVV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fda9b91ed671cc75b8adca1afa6e6f37cea7155d15ebef8f37d2d05d643699dc
Files
-
fda9b91ed671cc75b8adca1afa6e6f37cea7155d15ebef8f37d2d05d643699dc.exe windows:5 windows x64
307a8ed9726edc2641c2ce0c4cc6d6f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateThread
UnmapViewOfFile
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
ProcessIdToSessionId
Process32NextW
GetModuleHandleW
GetCurrentProcess
Sleep
GetProcAddress
LoadLibraryW
WaitForSingleObject
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
MapViewOfFile
CreateFileMappingW
SetFilePointer
GlobalFree
GlobalAlloc
GetModuleFileNameW
WriteFile
GetLastError
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetStringTypeW
GetTickCount
QueryPerformanceCounter
GetVersion
HeapSetInformation
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
LCMapStringW
FlsAlloc
SetLastError
CreateMutexW
GetLocalTime
MoveFileW
ReleaseMutex
OutputDebugStringW
OpenMutexW
MultiByteToWideChar
GetUserDefaultLangID
FlushFileBuffers
MoveFileExW
LoadLibraryExW
GetCurrentProcessId
LoadLibraryA
IsBadStringPtrW
IsBadReadPtr
WideCharToMultiByte
VirtualQuery
CreateDirectoryW
GetFileAttributesW
GetVersionExW
GetSystemInfo
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateFileA
DeviceIoControl
lstrlenA
LocalFree
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
lstrcpyA
lstrcatA
GetFileType
VirtualProtect
GetCurrentThreadId
HeapCreate
EncodePointer
DecodePointer
GetCommandLineW
GetStartupInfoW
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
GetDateFormatA
GetTimeFormatA
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
user32
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
MessageBoxW
advapi32
AdjustTokenPrivileges
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
shell32
SHGetSpecialFolderPathW
psapi
GetModuleFileNameExW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ole32
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
oleaut32
SysStringByteLen
SysAllocString
SysFreeString
VariantClear
VariantInit
SysAllocStringByteLen
Sections
.text Size: 361KB - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_WRITE
pgdate Size: 860KB - Virtual size: 860KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pgdate Size: 860KB - Virtual size: 860KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
pgdate Size: 860KB - Virtual size: 860KB
pgdate Size: 860KB - Virtual size: 860KB
IMAGE_SCN_MEM_READ
pgdate Size: 860KB - Virtual size: 860KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pgdate Size: 860KB - Virtual size: 860KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE