Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20231020-en
General
-
Target
03097f75904007de33f69ec77e02146fe2a0b3d3b2a923640677bb1f46815b07.bin.sample.gz
-
Size
78KB
-
MD5
af6f9b7b0ff42c356a9a0734e56c52a4
-
SHA1
092441089839b5d81c7974fc9dc397a8e51b206a
-
SHA256
24f1c2a20833b1d6f88cb5e73513cc0f163e7c552db78fb783523fb3e1c3a75d
-
SHA512
e5a413b4e865b88c34c9f0992d277af851afb8fa5ca84d367563eab43111e49dfc7bfd88e1924d5b56c337cdc258e6b79cf67861a39eef76b966750c1b030779
-
SSDEEP
1536:DiMiHX/8x5BsU7YyWo6A4v/2LPJTVZMnI1aqzmqVaRWqqdCaGBuVq7+9SMlJT:DiMsX0DB/YyPuuLPJTVZMI1aqzmJo4oP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sample
Files
-
03097f75904007de33f69ec77e02146fe2a0b3d3b2a923640677bb1f46815b07.bin.sample.gz.gz
-
sample.exe windows:6 windows x86
fd7b0d1539ab765a70828f984d33209e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetPriorityClass
GetCurrentProcess
Wow64DisableWow64FsRedirection
TerminateProcess
SetProcessShutdownParameters
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenProcess
Sleep
Wow64RevertWow64FsRedirection
GetLastError
GetProcAddress
ExitProcess
GetModuleHandleW
ReadFile
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindFirstVolumeW
FindNextFileW
WaitForMultipleObjects
SetThreadPriority
GetQueuedCompletionStatus
lstrlenA
DeleteCriticalSection
PostQueuedCompletionStatus
SetFileAttributesW
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
SetVolumeMountPointW
LocalFree
MoveFileExW
FindVolumeClose
GetCurrentProcessId
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
GetConsoleWindow
HeapCreate
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetLocalTime
CloseHandle
lstrcatW
CreateFileW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetCommandLineW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
FindClose
HeapReAlloc
SetFilePointerEx
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleHandleExW
GetCommandLineA
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
user32
wsprintfW
wsprintfA
ShowWindow
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
OpenProcessToken
shell32
CommandLineToArgvW
SHEmptyRecycleBinW
ShellExecuteW
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmEndSession
shlwapi
wvnsprintfW
PathFindExtensionW
PathRemoveFileSpecW
Sections
.text Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ