Static task
static1
Behavioral task
behavioral1
Sample
f321508fe4b4eaa01c6d56f479e9f13b3aa6304d0a6521f5a18eb0d7434c462b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f321508fe4b4eaa01c6d56f479e9f13b3aa6304d0a6521f5a18eb0d7434c462b.exe
Resource
win10v2004-20230915-en
General
-
Target
f321508fe4b4eaa01c6d56f479e9f13b3aa6304d0a6521f5a18eb0d7434c462b
-
Size
7.2MB
-
MD5
658d1773dc4bb766f11ceeaad261fe98
-
SHA1
e3f308c05623fab550c47a954fd25e0dc5cfc65c
-
SHA256
f321508fe4b4eaa01c6d56f479e9f13b3aa6304d0a6521f5a18eb0d7434c462b
-
SHA512
5c96594c9916a2aa46bd7298b892b92f1df5e749e65b39982b7997f1d4d7841b3b2b6b87b797859ace9d371ddb707dc0900d280e71699f249253d3c5b5f8d622
-
SSDEEP
196608:AZLjFQw0cf73BdazwqcdHHu2SF6HeZE4otBUq30KireWtk:MOS3BMzwqmHHu2SGeZPo8A2fm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f321508fe4b4eaa01c6d56f479e9f13b3aa6304d0a6521f5a18eb0d7434c462b
Files
-
f321508fe4b4eaa01c6d56f479e9f13b3aa6304d0a6521f5a18eb0d7434c462b.exe windows:6 windows x64
ca326a4876b453e09d5ab711189e83b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wldap32
ord41
bcrypt
BCryptGenRandom
oleacc
CreateStdAccessibleObject
dbghelp
SymCleanup
dwrite
DWriteCreateFactory
d2d1
ord1
uiautomationcore
UiaRaiseAutomationEvent
oleaut32
SysFreeString
ole32
PropVariantClear
uxtheme
IsThemeBackgroundPartiallyTransparent
shell32
SetCurrentProcessExplicitAppUserModelID
advapi32
CryptAcquireContextA
winspool.drv
ClosePrinter
comdlg32
GetSaveFileNameW
gdi32
GetTextFaceW
user32
GetMenuDefaultItem
kernel32
LoadLibraryExA
dwmapi
DwmEnableBlurBehindWindow
imm32
ImmSetCompositionWindow
msimg32
AlphaBlend
comctl32
_TrackMouseEvent
gdiplus
GdipGetPenDashCap197819
shlwapi
StrCpyNW
crypt32
CertOpenStore
winmm
timeSetEvent
ws2_32
listen
Sections
.text Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 314KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 835KB - Virtual size: 835KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ