Static task
static1
Behavioral task
behavioral1
Sample
b4e2ec262ff2f6518a2410089db41b0e750f7f10d02a13d10d77153f019aa8a5.exe
Resource
win7-20230831-en
General
-
Target
b4e2ec262ff2f6518a2410089db41b0e750f7f10d02a13d10d77153f019aa8a5
-
Size
1.2MB
-
MD5
411fbd0565e1e24300ef10ad8f1f9ae5
-
SHA1
8314b3e93a48ea1f31169cad0a9ad2b5dce78e8f
-
SHA256
b4e2ec262ff2f6518a2410089db41b0e750f7f10d02a13d10d77153f019aa8a5
-
SHA512
f8eefd06fab2a8ca888172b4c776a59ef74c84d3fb3b88db99a671ab256aa280793f18beea7d1f1138cc30bbe40032efa93a972bf22cc57e2ccc53befa6ef04e
-
SSDEEP
24576:AGtlqkNocW+8EdRC7qdSql9L7bq08yQ8YwN2TmcjMJZDqJE5:AGtlqQD81kxqyQLw4TmcgJZT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4e2ec262ff2f6518a2410089db41b0e750f7f10d02a13d10d77153f019aa8a5
Files
-
b4e2ec262ff2f6518a2410089db41b0e750f7f10d02a13d10d77153f019aa8a5.exe windows:6 windows x64
9221cadd230b1b8a4cba80d270d72b95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateDirectoryW
GetFullPathNameW
GetFileAttributesW
GetUserDefaultLCID
DeleteFileW
MoveFileExW
CopyFileW
MoveFileW
ReadFile
GetVolumeInformationW
CancelIo
TlsSetValue
SetLastError
EnterCriticalSection
FindNextFileW
WriteFile
GetDiskFreeSpaceW
SetFileTime
SetThreadPriority
LeaveCriticalSection
InitializeCriticalSection
FindClose
WaitForSingleObject
CreateFileW
GetCurrentThreadId
SuspendThread
ResumeThread
SetFileAttributesW
Sleep
GetFileInformationByHandle
FormatMessageW
LocalFileTimeToFileTime
GetLastError
FileTimeToSystemTime
GetCurrentThread
TerminateThread
TlsAlloc
CloseHandle
GetLocalTime
GetOverlappedResult
DeleteCriticalSection
SystemTimeToFileTime
TlsGetValue
SystemTimeToTzSpecificLocalTime
TlsFree
CreateEventA
GetTickCount
GetDriveTypeW
SetFilePointer
SetEndOfFile
FlushFileBuffers
GetFileSizeEx
GetFileSize
BackupRead
BackupSeek
GetFileTime
BackupWrite
CreateHardLinkW
SetFileValidData
FindFirstFileW
CreateMutexA
ReleaseMutex
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
SetPriorityClass
GetCommandLineW
SetSystemPowerState
GetCurrentProcess
GetThreadLocale
CreatePipe
DuplicateHandle
GetModuleHandleA
OpenProcess
ProcessIdToSessionId
TzSpecificLocalTimeToSystemTime
GetCurrentProcessId
SetThreadExecutionState
GetSystemTime
GetLongPathNameW
GetFileAttributesExW
GetStdHandle
SetConsoleMode
GetConsoleMode
WriteConsoleW
GetTempPathW
CreateProcessW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
UnmapViewOfFile
OpenMutexA
CreateFileMappingA
MapViewOfFile
DeviceIoControl
RemoveDirectoryW
FindFirstChangeNotificationW
GetVolumeNameForVolumeMountPointW
FindCloseChangeNotification
FindNextChangeNotification
GetModuleHandleW
GetEnvironmentVariableW
VirtualFree
VirtualAlloc
GetModuleFileNameW
SetEvent
GetVersionExA
GetEnvironmentStringsW
WriteConsoleA
OutputDebugStringA
AttachConsole
GetConsoleProcessList
OutputDebugStringW
FreeConsole
GetFileType
AllocConsole
SetThreadLocale
FindFirstFileExW
GetSystemDirectoryW
GlobalAlloc
GlobalFree
LoadLibraryW
GlobalLock
MultiByteToWideChar
WideCharToMultiByte
CreateMutexW
RtlCaptureStackBackTrace
GetExitCodeThread
K32GetModuleBaseNameA
RaiseException
K32GetModuleInformation
CreateThread
K32EnumProcessModules
IsBadReadPtr
SetUnhandledExceptionFilter
ExitProcess
SizeofResource
FindResourceA
LockResource
LoadResource
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetConsoleCP
GetCommandLineA
HeapAlloc
HeapReAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
ReadConsoleInputW
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetFilePointerEx
GetConsoleOutputCP
HeapSize
Sections
.text Size: 740KB - Virtual size: 739KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 229KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ