Static task
static1
Behavioral task
behavioral1
Sample
85b110f59cc6b92b916518dc45ad68b023851ce06297553dad551ae76d05f35e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
85b110f59cc6b92b916518dc45ad68b023851ce06297553dad551ae76d05f35e.exe
Resource
win10v2004-20230915-en
General
-
Target
85b110f59cc6b92b916518dc45ad68b023851ce06297553dad551ae76d05f35e
-
Size
32KB
-
MD5
34653767da1dc70d260ea0c75657cc4a
-
SHA1
d39bede63c5ba805a013c5037da1a9ee735712d1
-
SHA256
85b110f59cc6b92b916518dc45ad68b023851ce06297553dad551ae76d05f35e
-
SHA512
1a15e76ba332cd457b8bbeedb3e03741de23c1e6e868a26b985845505290f084c2644052b8bd26dd1251b97da4572b66dc8117bc07a231ef50920f0f3723bcc3
-
SSDEEP
384:Uh1hNDpk2FWml0sbqsa3y6NjyEdL6thyZV:UhNu2Aeza3TNjFL6tYZV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85b110f59cc6b92b916518dc45ad68b023851ce06297553dad551ae76d05f35e
Files
-
85b110f59cc6b92b916518dc45ad68b023851ce06297553dad551ae76d05f35e.exe windows:4 windows x86
510c6809510dcd2aeaa47e1e0848765c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
lstrlenW
CloseHandle
WaitForSingleObject
CreateThread
lstrlenA
MoveFileA
DeleteFileA
lstrcatA
lstrcpyA
GetModuleFileNameA
lstrcpynA
CreateProcessA
lstrcmpiA
OpenProcess
GetLastError
GetCommandLineA
GetProcAddress
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFree
HeapCreate
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
user32
EnumDesktopsA
GetProcessWindowStation
OpenDesktopA
SwitchDesktop
CloseDesktop
FindWindowA
PostMessageA
wsprintfA
shlwapi
PathFileExistsA
psapi
EnumProcesses
GetModuleBaseNameA
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ