Static task
static1
Behavioral task
behavioral1
Sample
cdcba161f3ed277f6a30917840d04909faac05a09e92bf90a69c70bbf61150e6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cdcba161f3ed277f6a30917840d04909faac05a09e92bf90a69c70bbf61150e6.exe
Resource
win10v2004-20230915-en
General
-
Target
cdcba161f3ed277f6a30917840d04909faac05a09e92bf90a69c70bbf61150e6
-
Size
4.7MB
-
MD5
e06ea25d1badfee616753de32b23e5a9
-
SHA1
87949f74e27aa72a52acb5c84e4049636811ae06
-
SHA256
cdcba161f3ed277f6a30917840d04909faac05a09e92bf90a69c70bbf61150e6
-
SHA512
25f014a656bd60509e35720f0825807e35423d495ff34a8633e8474c6fe4abe6a273c452740e1e409da9fc26f69287178db7b870942336aac907b757950fa374
-
SSDEEP
49152:6hX6YayKMap3qQqjmrk6lGQDH8wJdUxBfyxPPOBpSMy+14ifBxlp2pJiideE8kpS:xOs8HheYA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cdcba161f3ed277f6a30917840d04909faac05a09e92bf90a69c70bbf61150e6
Files
-
cdcba161f3ed277f6a30917840d04909faac05a09e92bf90a69c70bbf61150e6.exe windows:6 windows x64
b524f8ec65233426759df43a6f2e814e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlUnwindEx
RtlVirtualUnwind
RtlNtStatusToDosError
NtCancelIoFileEx
RtlPcToFileHeader
NtCreateFile
RtlCaptureContext
RtlLookupFunctionEntry
NtReadFile
NtWriteFile
NtDeviceIoControlFile
kernel32
FlsFree
FlsSetValue
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RegisterWaitForSingleObject
CloseHandle
SleepConditionVariableSRW
FlsGetValue
SetHandleInformation
FlsAlloc
GetStringTypeW
SetStdHandle
GetCPInfo
GetCurrentProcessId
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
ReleaseSRWLockShared
CreateMutexW
GetLastError
GetCurrentProcess
DuplicateHandle
TryAcquireSRWLockExclusive
GetSystemInfo
DeleteCriticalSection
SetFileCompletionNotificationModes
LeaveCriticalSection
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
EnterCriticalSection
Sleep
GetModuleHandleA
GetProcAddress
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
EncodePointer
FreeEnvironmentStringsW
CompareStringW
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
LCMapStringW
RaiseException
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
HeapAlloc
GetProcessHeap
HeapFree
IsProcessorFeaturePresent
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
CreateEventW
CancelIo
GetConsoleMode
GetFileType
GetStartupInfoW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetCurrentDirectoryW
ExitProcess
GetFullPathNameW
HeapSize
CreateNamedPipeW
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetConsoleOutputCP
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReleaseMutex
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
ws2_32
ioctlsocket
setsockopt
WSAIoctl
WSASend
send
WSAStartup
recv
getsockname
accept
listen
bind
WSASocketW
closesocket
WSACleanup
freeaddrinfo
shutdown
getaddrinfo
WSAGetLastError
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 898KB - Virtual size: 897KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ