Static task
static1
Behavioral task
behavioral1
Sample
913d3889c5bdd17fc99061e02deb1695858fc1c5b94e1e4ebf89b29382b1b086.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
913d3889c5bdd17fc99061e02deb1695858fc1c5b94e1e4ebf89b29382b1b086.exe
Resource
win10v2004-20231023-en
General
-
Target
913d3889c5bdd17fc99061e02deb1695858fc1c5b94e1e4ebf89b29382b1b086
-
Size
1.6MB
-
MD5
8b678bb594ccbddf78534b8258a4e159
-
SHA1
fc46883adb0ef8eb02444e88a4d6e9bbc4b4ac45
-
SHA256
913d3889c5bdd17fc99061e02deb1695858fc1c5b94e1e4ebf89b29382b1b086
-
SHA512
0561e18806a64e7c26c29736dc4a91f847e426aedbfb75e116d29032a00f5810af2922f1039284fcd7447b2a9f9adf12c95e498ced3d634f8d7dca99d13e08f9
-
SSDEEP
24576:v+tS0RSuKKOA5UoBcE7lYey8oCIfm1b+scD6VPYFSn7Yt4FnkezdDQTwt6ajqUTA:vr0RSRoGEg5Cb57FnkqETwt1jnAcS06
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 913d3889c5bdd17fc99061e02deb1695858fc1c5b94e1e4ebf89b29382b1b086
Files
-
913d3889c5bdd17fc99061e02deb1695858fc1c5b94e1e4ebf89b29382b1b086.exe windows:5 windows x86
1bdb095bd6f86fbc895109d4f81f8005
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetCurrentThreadId
CloseHandle
GetLocalTime
InitializeCriticalSectionAndSpinCount
Sleep
GetLastError
WaitForSingleObject
LocalFree
CreateProcessW
GetModuleHandleW
GetVersionExW
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcess
OpenProcess
SystemTimeToFileTime
GetSystemTime
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetLongPathNameW
GetFileAttributesExW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryExW
ReadFile
SetEndOfFile
GetFileSize
HeapFree
HeapAlloc
GetProcessHeap
GetDiskFreeSpaceW
InterlockedExchangeAdd
CreateDirectoryW
GetFullPathNameW
lstrlenW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
GetTempFileNameW
GetTickCount
DeviceIoControl
FormatMessageW
SetLastError
SetFilePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
GetStdHandle
GetFileType
WriteFile
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
InterlockedExchange
GetFileSizeEx
VirtualQuery
GetModuleFileNameW
GetCurrentProcessId
GetProcAddress
CreateFileW
GetStringTypeW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ