Static task
static1
Behavioral task
behavioral1
Sample
dfa84b5a181211bf2b3cbb8f089128cabf629073e441221ad3408ece5b400b83.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dfa84b5a181211bf2b3cbb8f089128cabf629073e441221ad3408ece5b400b83.exe
Resource
win10v2004-20230915-en
General
-
Target
dfa84b5a181211bf2b3cbb8f089128cabf629073e441221ad3408ece5b400b83
-
Size
4.8MB
-
MD5
4a5e8e2cda5141b5a8fffebee0949501
-
SHA1
aab7e9d565bbb28b7e681ae4574101deb8336e96
-
SHA256
dfa84b5a181211bf2b3cbb8f089128cabf629073e441221ad3408ece5b400b83
-
SHA512
d87322cba2dc8bb6b9db9dd4897c096c353947b047da60e5878fb220bf76588a59acaeeab34b5a523b221e410e829e5814eade37b8fa8248e24e9ef0d378b040
-
SSDEEP
98304:2cR+zEDA/Fd72h7NrwjCyO6dTJ0OclWB47TA0qCwph+v9SuE:6g4KcjFhJwlH3cz2U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfa84b5a181211bf2b3cbb8f089128cabf629073e441221ad3408ece5b400b83
Files
-
dfa84b5a181211bf2b3cbb8f089128cabf629073e441221ad3408ece5b400b83.exe windows:5 windows x86
49b1a53532e739bdea64f239918349aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushConsoleInputBuffer
GetSystemTime
ReadConsoleInputA
SetConsoleMode
GlobalMemoryStatus
FreeLibrary
GetProcAddress
SystemTimeToFileTime
DecodePointer
HeapSize
GetTimeZoneInformation
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetFileAttributesExA
Sleep
SleepEx
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
GetTickCount
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsA
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetLastError
FormatMessageA
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
GetStringTypeW
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wldap32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217
ws2_32
recv
WSASetLastError
getaddrinfo
__WSAFDIsSet
socket
bind
freeaddrinfo
accept
listen
recvfrom
sendto
send
closesocket
connect
getservbyname
gethostbyname
htonl
shutdown
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSAGetLastError
WSACleanup
gethostname
ioctlsocket
select
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
advapi32
CryptGetUserKey
RegisterEventSourceA
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101.2MB - Virtual size: 101.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ