Static task
static1
Behavioral task
behavioral1
Sample
ea3414ea65b625321528d826d1c1e5f0e3641668f795094a2f7833db5ca55f9a.exe
Resource
win7-20230831-en
General
-
Target
ea3414ea65b625321528d826d1c1e5f0e3641668f795094a2f7833db5ca55f9a
-
Size
2.0MB
-
MD5
4f18ee4079d7e99b83bd2750e1f4bc90
-
SHA1
3c846735ae0ccff2b6709bf536417931038f37ae
-
SHA256
ea3414ea65b625321528d826d1c1e5f0e3641668f795094a2f7833db5ca55f9a
-
SHA512
384049997456f8fcddedd30974e9e83fe775b0dc8a6ed0625d06f0ce09b926a598a415ddc5e36077fd45b9227ddd837bb00d34cbf509b2d65f460df8471b11bb
-
SSDEEP
49152:ttqNcVG7207+yxpiqgNI37X1aPs3sEV9qjgjc:ttdVG720y2iqIIrX1Zjc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea3414ea65b625321528d826d1c1e5f0e3641668f795094a2f7833db5ca55f9a
Files
-
ea3414ea65b625321528d826d1c1e5f0e3641668f795094a2f7833db5ca55f9a.exe windows:5 windows x86
2c5124e4c3f72e7a9655ce0882f2d1da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetSystemDirectoryW
GetComputerNameW
GetTempPathW
CreateProcessW
WaitForSingleObject
FindFirstFileW
GetPrivateProfileStringA
ReadFile
CreateDirectoryW
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
DeleteFileW
Sleep
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalFree
GetCommandLineW
SetCurrentDirectoryW
FindFirstFileA
GetModuleFileNameW
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SleepEx
GetTickCount
ExpandEnvironmentStringsA
FreeLibrary
GetProcAddress
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
SetLastError
FormatMessageA
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
FlushConsoleInputBuffer
WriteFile
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
GetSystemTime
SystemTimeToFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
ExitProcess
GetACP
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetFileAttributesExW
SetEndOfFile
DecodePointer
FindFirstFileExW
FindNextFileW
IsValidCodePage
user32
GetForegroundWindow
GetShellWindow
GetWindowRect
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetSystemMetrics
PostMessageW
GetWindowThreadProcessId
GetDesktopWindow
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
shell32
ShellExecuteExW
ShellExecuteW
SHChangeNotify
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoUninitialize
CoInitialize
shlwapi
PathIsDirectoryW
PathRemoveFileSpecW
urlmon
URLDownloadToFileW
ws2_32
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
getservbyname
getpeername
connect
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
shutdown
htonl
gethostbyname
closesocket
getsockname
wldap32
ord200
ord301
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 347KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 38KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE