Static task
static1
Behavioral task
behavioral1
Sample
1c82fbd0b72ab35d9bb289d823fcff1e54d8e7676d6ee92a20cef70205f04018.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1c82fbd0b72ab35d9bb289d823fcff1e54d8e7676d6ee92a20cef70205f04018.exe
Resource
win10v2004-20230915-en
General
-
Target
1c82fbd0b72ab35d9bb289d823fcff1e54d8e7676d6ee92a20cef70205f04018
-
Size
43KB
-
MD5
ae58df78cbde6a9bc750fee292177337
-
SHA1
44c34fc8a96c2b38273546231718b9262f481fbe
-
SHA256
1c82fbd0b72ab35d9bb289d823fcff1e54d8e7676d6ee92a20cef70205f04018
-
SHA512
12837bbc52025275655412b83551cd126151dc29efe8fc686d8a188bc4837b2eaf5d902651abf2760009a327b0f2d18319f6d626f37f6b48dc81cf4260115bb6
-
SSDEEP
768:pegE2gi+h0QObzKwot2nb0/eF24iQgk8jX8wryKdVsG6CcX1PJjDa+:EgJgi+hffwot2nb0/eF24iQgkYsyyKdG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c82fbd0b72ab35d9bb289d823fcff1e54d8e7676d6ee92a20cef70205f04018
Files
-
1c82fbd0b72ab35d9bb289d823fcff1e54d8e7676d6ee92a20cef70205f04018.exe windows:5 windows x64
bb6ca1d006a6fd4051d6ca20dd19db95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
DefWindowProcW
UnregisterClassW
SetActiveWindow
RegisterClassExW
PostMessageW
MessageBoxW
LoadStringW
GetWindow
EnumWindows
DestroyWindow
CreateWindowExW
msvcrt
__winitenv
_wcmdln
signal
__lconv_init
_fpreset
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__setusermatherr
memset
memcpy
swprintf
_wcsicmp
wcslen
wcscpy
malloc
free
_initterm
kernel32
Sleep
TlsGetValue
LeaveCriticalSection
InitializeCriticalSection
GetLastError
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
SetUnhandledExceptionFilter
GetStartupInfoW
WideCharToMultiByte
SearchPathW
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
GetCommandLineW
FreeLibrary
DeactivateActCtx
CreateActCtxW
ActivateActCtx
GetCurrentProcessId
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ