Static task
static1
Behavioral task
behavioral1
Sample
c3dc6d16d502203643ca7d0dc9cd8305e98a2f0fda1a881d82ecddec03c0c083.exe
Resource
win7-20230831-en
General
-
Target
c3dc6d16d502203643ca7d0dc9cd8305e98a2f0fda1a881d82ecddec03c0c083
-
Size
541KB
-
MD5
25c92cd5bff419c6c3f6aeda260c9e30
-
SHA1
f9e716194be48b3490a25f802fa09e6798aaa1bd
-
SHA256
c3dc6d16d502203643ca7d0dc9cd8305e98a2f0fda1a881d82ecddec03c0c083
-
SHA512
65364fb63e66c5b216affe07f59752637eacf68985d07c603798adc67623e4c8124babaeb5cf6735629b97b87fb0e82ecc08f9be40c7784799ffec05310edc72
-
SSDEEP
12288:pn/NkmEfzSEAbV7eDg+gCBrH/oCGsH6MXPHhDhPaBVtu:d/NkmS1AADgXCIM/Jh8Vtu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3dc6d16d502203643ca7d0dc9cd8305e98a2f0fda1a881d82ecddec03c0c083
Files
-
c3dc6d16d502203643ca7d0dc9cd8305e98a2f0fda1a881d82ecddec03c0c083.exe windows:6 windows x86
9f7d35d13d490935ed4b82591527ee84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
LocalFree
GetPrivateProfileStringW
CreateFileW
ReadFile
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFileAttributesW
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
Sleep
GetCurrentProcessId
CreateProcessW
OpenProcess
GetLocalTime
FindResourceExW
GetModuleHandleW
GlobalAlloc
GlobalFree
LocalAlloc
lstrcmpA
CopyFileW
MoveFileExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumProcesses
K32GetModuleFileNameExW
GetConsoleMode
GetConsoleCP
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
GetProcessHeap
HeapSize
HeapFree
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
SetCurrentDirectoryW
GetCommandLineW
FreeLibrary
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwind
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
WriteConsoleW
shell32
ShellExecuteExW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationW
oleaut32
SystemTimeToVariantTime
VariantTimeToSystemTime
VarUdateFromDate
advapi32
GetTokenInformation
CheckTokenMembership
FreeSid
OpenProcessToken
DuplicateTokenEx
LookupAccountSidW
GetUserNameW
AllocateAndInitializeSid
shlwapi
PathAppendW
PathCanonicalizeW
PathFileExistsW
wintrust
WinVerifyTrust
crypt32
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
Sections
.text Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 79KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE