Static task
static1
Behavioral task
behavioral1
Sample
498dc44d67901b6cd94ba3fb2fb5cb21c5321b320aa0ca246c5656005e5e0cdb.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
498dc44d67901b6cd94ba3fb2fb5cb21c5321b320aa0ca246c5656005e5e0cdb.exe
Resource
win10v2004-20230915-en
General
-
Target
498dc44d67901b6cd94ba3fb2fb5cb21c5321b320aa0ca246c5656005e5e0cdb
-
Size
144KB
-
MD5
f2964e64532c2c55d9b128a8ef921204
-
SHA1
c09a257bf58c29959e8f7339287ca390e58411e7
-
SHA256
498dc44d67901b6cd94ba3fb2fb5cb21c5321b320aa0ca246c5656005e5e0cdb
-
SHA512
cc26e3c3c4734cac3332170fe8183b0b46e3db4f2781ff13246258ddec7a98a443588300674efa3a15b4eb9604a20b0354acff46a07419fe299b1d7de2619bd4
-
SSDEEP
3072:wRpXOmhQ3ScPSoxvshTsKEFUzXDJWJc8l5D7Ka:kYCcPSoOrEuGZK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 498dc44d67901b6cd94ba3fb2fb5cb21c5321b320aa0ca246c5656005e5e0cdb
Files
-
498dc44d67901b6cd94ba3fb2fb5cb21c5321b320aa0ca246c5656005e5e0cdb.exe windows:5 windows x86
e124a6cece7bba9d313f639ed6516504
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcessHeap
MultiByteToWideChar
TerminateProcess
GetModuleFileNameW
GetFileAttributesW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
ExpandEnvironmentStringsA
HeapAlloc
WriteConsoleW
SetFilePointerEx
HeapReAlloc
GetModuleHandleW
FindClose
SetLastError
GetProcAddress
LoadLibraryW
GetLastError
GetCurrentProcess
FlushFileBuffers
WideCharToMultiByte
DeleteCriticalSection
GetLocalTime
CloseHandle
DeleteFileW
EnterCriticalSection
Sleep
CreateFileW
WaitForSingleObject
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
OutputDebugStringA
WriteFile
CreateToolhelp32Snapshot
HeapSize
GetConsoleMode
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
GetFileType
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
DecodePointer
advapi32
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
DuplicateTokenEx
userenv
CreateEnvironmentBlock
wtsapi32
WTSQueryUserToken
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ