Static task
static1
Behavioral task
behavioral1
Sample
44be284bca3f7c2d92d2f9021a56071e8b0316643b7d06da0ef000b97f09503e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
44be284bca3f7c2d92d2f9021a56071e8b0316643b7d06da0ef000b97f09503e.exe
Resource
win10v2004-20230915-en
General
-
Target
44be284bca3f7c2d92d2f9021a56071e8b0316643b7d06da0ef000b97f09503e
-
Size
3.9MB
-
MD5
e21d65388faadf61f360d18e37389d6f
-
SHA1
ff911e9776cc87715cf0481188a055f484724b0d
-
SHA256
44be284bca3f7c2d92d2f9021a56071e8b0316643b7d06da0ef000b97f09503e
-
SHA512
85e28e12a96a7032a70a61b55d24dd77cb62507f901b6908cd43d3b5b6feb30bed831cf5de9e8bf1f3f6e1301899ea5661efb577fcaefd05004519b606b360f6
-
SSDEEP
49152:2YDtEXcAew/0iIOUZw33dRwZqiRiKVcdIA8tkEBQWluAQHK:3WrPiHu8JzluAQH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 44be284bca3f7c2d92d2f9021a56071e8b0316643b7d06da0ef000b97f09503e
Files
-
44be284bca3f7c2d92d2f9021a56071e8b0316643b7d06da0ef000b97f09503e.exe windows:6 windows x64
94c72df51f27fe9555b67ff62cff2078
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtCreateFile
RtlLookupFunctionEntry
NtReadFile
NtWriteFile
RtlNtStatusToDosError
RtlCaptureContext
NtCancelIoFileEx
NtDeviceIoControlFile
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
kernel32
FlsSetValue
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FlsFree
FlsGetValue
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CompareStringW
FindFirstFileExW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
SetHandleInformation
TlsGetValue
GetCurrentProcessId
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
LCMapStringW
GetCurrentProcess
DuplicateHandle
GetSystemInfo
IsDebuggerPresent
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSListHead
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
GetCurrentThreadId
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
CreateMutexW
GetLastError
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetCommandLineA
FlsAlloc
HeapSize
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetConsoleOutputCP
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
CopyFileExW
CreateEventW
CancelIo
GetConsoleMode
GetFileType
CreateThread
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentThread
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ws2_32
WSAStartup
getsockopt
ioctlsocket
bind
WSASocketW
getpeername
getsockname
recv
send
WSASend
setsockopt
WSAIoctl
closesocket
WSAGetLastError
WSACleanup
connect
freeaddrinfo
getaddrinfo
shutdown
advapi32
SystemFunction036
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
secur32
DecryptMessage
EncryptMessage
FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
DeleteSecurityContext
QueryContextAttributesW
FreeCredentialsHandle
crypt32
CertDuplicateCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
bcrypt
BCryptGenRandom
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ