Static task
static1
Behavioral task
behavioral1
Sample
a498037ac9740d2464edade9202fb6b91234b4c1aa887051612fe99f074e21f9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a498037ac9740d2464edade9202fb6b91234b4c1aa887051612fe99f074e21f9.exe
Resource
win10v2004-20230915-en
General
-
Target
a498037ac9740d2464edade9202fb6b91234b4c1aa887051612fe99f074e21f9
-
Size
4.8MB
-
MD5
7d71be5f362ed649be0b1304b3014f02
-
SHA1
cea52695c306e125120b1b25c071ca37e3a05e63
-
SHA256
a498037ac9740d2464edade9202fb6b91234b4c1aa887051612fe99f074e21f9
-
SHA512
392a0e01e22dc83ce3ccd4350fa65b45b290d32e15f62015c5b7636e3ea3a54e9affbd8dc89f535d91e58bbc78a098edb02e0c71a54355a04b6b08763416b4ce
-
SSDEEP
98304:2cR+zEDA/Fd72h7NrwjCyO6dTJ0OclWB47TA0qCwph+v9SuM:6g4KcjFhJwlH3cz28
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a498037ac9740d2464edade9202fb6b91234b4c1aa887051612fe99f074e21f9
Files
-
a498037ac9740d2464edade9202fb6b91234b4c1aa887051612fe99f074e21f9.exe windows:5 windows x86
49b1a53532e739bdea64f239918349aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushConsoleInputBuffer
GetSystemTime
ReadConsoleInputA
SetConsoleMode
GlobalMemoryStatus
FreeLibrary
GetProcAddress
SystemTimeToFileTime
DecodePointer
HeapSize
GetTimeZoneInformation
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetFileAttributesExA
Sleep
SleepEx
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
GetTickCount
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsA
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetLastError
FormatMessageA
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
GetStringTypeW
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wldap32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217
ws2_32
recv
WSASetLastError
getaddrinfo
__WSAFDIsSet
socket
bind
freeaddrinfo
accept
listen
recvfrom
sendto
send
closesocket
connect
getservbyname
gethostbyname
htonl
shutdown
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSAGetLastError
WSACleanup
gethostname
ioctlsocket
select
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
advapi32
CryptGetUserKey
RegisterEventSourceA
ReportEventA
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
DeregisterEventSource
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101.2MB - Virtual size: 101.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ