Static task
static1
Behavioral task
behavioral1
Sample
c29f9303abd03eae520d39e9f8e36b5dd7e8f7d2c38fb6d0df6a8c8e24b43e64.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c29f9303abd03eae520d39e9f8e36b5dd7e8f7d2c38fb6d0df6a8c8e24b43e64.exe
Resource
win10v2004-20230915-en
General
-
Target
c29f9303abd03eae520d39e9f8e36b5dd7e8f7d2c38fb6d0df6a8c8e24b43e64
-
Size
6.7MB
-
MD5
7920ed46e9fa574d3a6a62f0456098a4
-
SHA1
690d28a374a8760d5506773b9e04f4427cd477cc
-
SHA256
c29f9303abd03eae520d39e9f8e36b5dd7e8f7d2c38fb6d0df6a8c8e24b43e64
-
SHA512
1149b31dbbf54973cc7ddabf7f5d20cac03ffa5cce4576753feb8e02406243d77938f22026a1614f24d565df364c66f91e3d579b32dbdbfde497fac728985cc2
-
SSDEEP
98304:BCUcgXDKe8v9h5EXcNBb3vDTplwGUWMEM80NvrdjltO42DdS4PMfFZBb:B4sKz3NFDd6g0NvBje42DdjmFZBb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c29f9303abd03eae520d39e9f8e36b5dd7e8f7d2c38fb6d0df6a8c8e24b43e64
Files
-
c29f9303abd03eae520d39e9f8e36b5dd7e8f7d2c38fb6d0df6a8c8e24b43e64.exe windows:5 windows x86
0d95fe5455fd158272f3716025e9d588
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
websockets
lws_write
activeds
ord3
netapi32
NetUserGetInfo
mfc90u
ord1553
msvcr90
_CItan
kernel32
MapViewOfFile
user32
DrawEdge
gdi32
GetObjectType
msimg32
TransparentBlt
winspool.drv
GetPrinterW
advapi32
RegDeleteValueW
shell32
SHAppBarMessage
comctl32
ImageList_GetImageCount
shlwapi
SHCreateStreamOnFileW
ole32
CoInitializeEx
oleaut32
SysFreeString
gdiplus
GdipAddPathEllipseI
msvcp90
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
sflmsgmodel
?RegisterReceiver@c_SFLMsgModel@SFL@@QAEXPAVCWnd@@I@Z
sfllogger
?SetUser@c_SFLFileLogger@SFL@@QAEXPB_W@Z
xmllite
CreateXmlReader
imm32
ImmAssociateContext
iphlpapi
GetAdaptersInfo
winmm
PlaySoundW
imagehlp
ImageDirectoryEntryToData
version
VerQueryValueW
urlmon
FindMimeFromData
wininet
HttpSendRequestW
msvcrt
strncpy
psapi
GetMappedFileNameW
Sections
.text Size: 5.6MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lrdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lrdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ