Static task
static1
Behavioral task
behavioral1
Sample
2dcc1cb99b19750d6c98938d6a277e9b0998f4ef03ade1a72d61791227de03da.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2dcc1cb99b19750d6c98938d6a277e9b0998f4ef03ade1a72d61791227de03da.exe
Resource
win10v2004-20230915-en
General
-
Target
2dcc1cb99b19750d6c98938d6a277e9b0998f4ef03ade1a72d61791227de03da
-
Size
598KB
-
MD5
a3b97389f0e0df8f77ff75d7834d5f72
-
SHA1
4c3faa23cabb5923aa796be521785e5bfa740041
-
SHA256
2dcc1cb99b19750d6c98938d6a277e9b0998f4ef03ade1a72d61791227de03da
-
SHA512
263eaebc3216e6fa5ee0a258894206d28e129c4b2fca6ff489d5b70ffd09058f6a9a5194ed6101329bbaefebfd6b9fafe8faf0aa2048c7d294932c3797e7b5cc
-
SSDEEP
12288:1p2G9W3SfS+Kb2yCMwRN3xIFhSMXllu5TvB:B9qSfZyC1/xIFhSMXlazB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dcc1cb99b19750d6c98938d6a277e9b0998f4ef03ade1a72d61791227de03da
Files
-
2dcc1cb99b19750d6c98938d6a277e9b0998f4ef03ade1a72d61791227de03da.exe windows:6 windows x86
c06b374476a2d531870746e7cca5ae19
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wtsapi32
WTSEnumerateProcessesW
WTSQueryUserToken
WTSFreeMemory
userenv
DestroyEnvironmentBlock
GetAppContainerFolderPath
DeleteAppContainerProfile
CreateEnvironmentBlock
CreateAppContainerProfile
kernel32
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetModuleHandleW
GetProcAddress
LocalFree
InitializeProcThreadAttributeList
SetLastError
SleepEx
GetTickCount64
IsValidCodePage
CreateProcessW
GetProcessHeap
HeapFree
HeapAlloc
GetExitCodeProcess
GetCurrentProcessId
GetCurrentDirectoryW
CloseHandle
GetLastError
OpenProcess
GetFileAttributesW
WaitForSingleObject
GetProcessId
SetConsoleCtrlHandler
GetACP
GetOEMCP
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleOutputCP
HeapSize
HeapReAlloc
SetEndOfFile
GetCurrentProcess
GetStringTypeW
ReadConsoleW
DeviceIoControl
GetFinalPathNameByHandleW
GetModuleFileNameW
CreateFileW
GetFullPathNameW
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
ReadFile
GetFileInformationByHandleEx
WriteFile
DeleteFileW
MoveFileExW
SetFilePointerEx
ExpandEnvironmentStringsW
MultiByteToWideChar
FormatMessageW
DecodePointer
GetStdHandle
SetConsoleMode
GetConsoleMode
WriteConsoleW
GetFileType
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetStdHandle
GetCPInfo
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
advapi32
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
LookupPrivilegeValueW
GetTokenInformation
AdjustTokenPrivileges
SetThreadToken
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
ConvertSidToStringSidW
IsWellKnownSid
CreateWellKnownSid
CopySid
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
shell32
ShellExecuteExW
ole32
CoUninitialize
CoTaskMemFree
CoInitialize
Sections
.text Size: 305KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ