Static task
static1
Behavioral task
behavioral1
Sample
95476dcd1562cfd82fb9a7db0c96eefd781fa837c6a4c0e6db0024773e0af786.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
95476dcd1562cfd82fb9a7db0c96eefd781fa837c6a4c0e6db0024773e0af786.exe
Resource
win10v2004-20230915-en
General
-
Target
95476dcd1562cfd82fb9a7db0c96eefd781fa837c6a4c0e6db0024773e0af786
-
Size
14.3MB
-
MD5
d8ab0f9962775dfe946de89e8d58e461
-
SHA1
14c7cd725a882bd28de4c4622f72b48f6378fe05
-
SHA256
95476dcd1562cfd82fb9a7db0c96eefd781fa837c6a4c0e6db0024773e0af786
-
SHA512
1e840912c8500452d94505a83a87288d91e730010182ec95df67c6287387468d87759421e6a6d897f3bdced02a1c075d5e0009e91405a51ffe1382d81f5314dd
-
SSDEEP
196608:U4gDmJggQJEbF+B9/swpTS+A99k7KFZe2EuRTMrCev8hg2usfu2K6JlsRK87Kj1h:NKQnu0kTSVWKF5TLZpuaJSRX7Kj1xv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95476dcd1562cfd82fb9a7db0c96eefd781fa837c6a4c0e6db0024773e0af786
Files
-
95476dcd1562cfd82fb9a7db0c96eefd781fa837c6a4c0e6db0024773e0af786.exe windows:4 windows x86
948b2b1fdab74a9dbb5fe1fe76e694c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
GetModuleHandleA
winmm
midiStreamStop
ws2_32
ntohl
user32
MoveWindow
gdi32
GetStockObject
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegQueryValueA
shell32
DragFinish
ole32
CLSIDFromProgID
oleaut32
VariantInit
comctl32
ImageList_DragShowNolock
secur32
GetUserNameExA
wininet
DeleteUrlCacheEntryW
urlmon
URLDownloadToFileW
shlwapi
StrTrimA
iphlpapi
GetAdaptersInfo
Sections
.text Size: - Virtual size: 13.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mapo Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mapo Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mapo2 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE