Static task
static1
Behavioral task
behavioral1
Sample
a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe
Resource
win10v2004-20230915-en
General
-
Target
a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894
-
Size
3.9MB
-
MD5
e0f5e8b2c0368e6e4634b50a461c46f4
-
SHA1
9d14972d61544181837feafda360baa07eb73e9f
-
SHA256
a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894
-
SHA512
e3d839fadb917454e308578e9b2d8c6a4c137656f357cbbfa02804773ea7f80b0105199f2d05f78cc2c7cba6d5ca140c05de833df6a163facae15c83758780b5
-
SSDEEP
49152:hSdjhZypyvZOXSyb6qLS7Ex/+0tPpQbwRhd85I8DvMtYEeTat:55jtmkhU88Tat
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894
Files
-
a983acd5ea7e9fb1eb2ed57f6e9393615659c5c048d39fbd8b649511f823a894.exe windows:6 windows x64
335537892869cb7e9cc98f4d05660ab5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtReadFile
RtlCaptureContext
RtlNtStatusToDosError
NtWriteFile
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlVirtualUnwind
RtlUnwindEx
kernel32
FlsSetValue
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
FlsFree
GetACP
IsValidCodePage
CompareStringW
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsAlloc
SetHandleInformation
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
LCMapStringW
GetCurrentProcess
DuplicateHandle
GetSystemInfo
GetCurrentThreadId
CreateIoCompletionPort
GetQueuedCompletionStatusEx
FlsAlloc
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
FlsGetValue
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
CreateMutexW
GetLastError
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
HeapSize
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetConsoleOutputCP
TlsSetValue
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
TlsGetValue
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
CopyFileExW
CreateEventW
CancelIo
GetConsoleMode
GetFileType
CreateThread
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentThread
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ws2_32
getsockopt
connect
bind
WSASocketW
getpeername
getsockname
send
WSASend
setsockopt
WSAIoctl
recv
closesocket
ioctlsocket
WSAStartup
WSACleanup
freeaddrinfo
WSAGetLastError
getaddrinfo
shutdown
advapi32
SystemFunction036
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
secur32
EncryptMessage
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
DecryptMessage
ApplyControlToken
DeleteSecurityContext
QueryContextAttributesW
FreeCredentialsHandle
AcquireCredentialsHandleA
crypt32
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
bcrypt
BCryptGenRandom
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ