Static task
static1
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20230915-en
General
-
Target
build.exe
-
Size
61KB
-
MD5
4ccea6b3b16cb786c8820bdb361126e0
-
SHA1
000ad3d2d27f108a51cc876260306d41d6834a14
-
SHA256
13ee34d596fb602df5cc22195cdafe353b6c7e94b1c45521df1dfb25c7c30d32
-
SHA512
491926fbdfc7d44b7aacda2bfe405b4b5fb977b7fa4565fd6d579ef928d432307b31ac107344c719332d3d63398dbe7cd2360e191a4af332e9235dfdf032babb
-
SSDEEP
768:izWwFvb3g++JO2dfbghg0g6sZPLpIz2yWVn/7Y4WbOlsjKgykHoLUTE5:ihIghgTs3b4BlWKgybqE5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource build.exe
Files
-
build.exe.exe windows:5 windows x86
fb78f8650268ff902b58adc69fc03bab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
UnmapViewOfFile
lstrcmpiW
lstrcpyA
lstrcpyW
lstrcatW
lstrlenA
lstrlenW
WaitForSingleObjectEx
CreateEventW
CreateFileMappingW
LoadLibraryW
CreateProcessW
GetStartupInfoW
GetCommandLineW
GetDriveTypeW
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
CreateFileW
GetNativeSystemInfo
GetFileAttributesW
FindFirstFileExW
FindNextFileW
CopyFileW
MoveFileExW
GetVolumeInformationA
GetVolumeInformationW
GetComputerNameW
GetVersionExW
FindFirstVolumeA
FindNextVolumeA
FindVolumeClose
SetVolumeMountPointA
GetVolumePathNamesForVolumeNameA
WTSGetActiveConsoleSessionId
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetTickCount
CloseHandle
FindClose
SetFilePointerEx
DeviceIoControl
ReadFile
WriteFile
GetFileSizeEx
GetFileSize
UnlockFile
LockFile
GetLogicalDrives
Sleep
WaitForMultipleObjects
WaitForSingleObject
SetEvent
GetLastError
TerminateThread
CreateThread
TerminateProcess
ExitProcess
GetCurrentProcess
OpenProcess
GetProcessHeap
HeapFree
HeapAlloc
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
SetFileAttributesW
GetProcAddress
user32
wsprintfW
advapi32
CryptEncrypt
CryptGenRandom
CryptReleaseContext
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
EnumServicesStatusA
EnumDependentServicesA
DeleteService
ControlService
CloseServiceHandle
OpenProcessToken
CryptDestroyKey
CryptAcquireContextW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
DuplicateTokenEx
CreateProcessAsUserW
GetUserNameW
LookupPrivilegeValueW
AllocateAndInitializeSid
AdjustTokenPrivileges
SetTokenInformation
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
shlwapi
StrStrIW
StrStrIA
StrStrW
PathFindExtensionW
StrToIntA
crypt32
CryptImportPublicKeyInfo
CryptStringToBinaryW
CryptDecodeObjectEx
psapi
GetProcessImageFileNameW
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ufo4 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ