Static task
static1
Behavioral task
behavioral1
Sample
bcb7b884bfc12a27b16cbf822b2b98f2c5543f2142db0d3033b88ae87740ad2c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
bcb7b884bfc12a27b16cbf822b2b98f2c5543f2142db0d3033b88ae87740ad2c.exe
Resource
win10v2004-20231020-en
General
-
Target
bcb7b884bfc12a27b16cbf822b2b98f2c5543f2142db0d3033b88ae87740ad2c
-
Size
344KB
-
MD5
3a26300264d4715106c7b8754a87992e
-
SHA1
5ef47710cf183a14d0859d329d44a785b4b5dfa2
-
SHA256
bcb7b884bfc12a27b16cbf822b2b98f2c5543f2142db0d3033b88ae87740ad2c
-
SHA512
7ffce682d179dc3ea69abadcfe0b71a240b3190ae6543aa25e8abaeb5825e3d91624bba96b59efc1adad572467d150a822ba98fb3cda592ef05c4bcc55b47898
-
SSDEEP
6144:dpWMSmgY0IyFpXjsCEqhp3xuo8Pr7Jjc7wPxfC:WHP7LFVst+0oA71+AC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcb7b884bfc12a27b16cbf822b2b98f2c5543f2142db0d3033b88ae87740ad2c
Files
-
bcb7b884bfc12a27b16cbf822b2b98f2c5543f2142db0d3033b88ae87740ad2c.exe windows:5 windows x86
c3803752167a683f3dbd2e2ab3d19b6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
IsPwrHibernateAllowed
ReadGlobalPwrPolicy
kernel32
LoadLibraryExW
LocalFree
GetCurrentConsoleFont
AddConsoleAliasA
HeapWalk
HeapCreate
EraseTape
EnumSystemLocalesA
GetModuleHandleW
GetProcessAffinityMask
SetFileAttributesW
DeleteVolumeMountPointW
LockFile
GetLocaleInfoW
FillConsoleOutputAttribute
GetConsoleCursorInfo
GlobalFindAtomA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GlobalAddAtomW
FindFirstFileA
wininet
RetrieveUrlCacheEntryStreamW
msvcrt
memset
user32
GetWindowRect
InsertMenuA
GetClipboardFormatNameA
SetCursor
ShowCaret
IsWindow
ole32
CoFreeUnusedLibrariesEx
gdi32
GetDeviceCaps
GetObjectW
GetCharWidthW
GetPaletteEntries
GetBitmapBits
winspool.drv
FindNextPrinterChangeNotification
Sections
qxejodg Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
camztlf Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data1 Size: 20KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m5Fih Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
qxejodg: Size: 4KB - Virtual size: 6B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ