Static task
static1
Behavioral task
behavioral1
Sample
089143232eed0f74efe27bb72f67acb157c583a513deba51df0a6afeb7247d39.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
089143232eed0f74efe27bb72f67acb157c583a513deba51df0a6afeb7247d39.exe
Resource
win10v2004-20231023-en
General
-
Target
089143232eed0f74efe27bb72f67acb157c583a513deba51df0a6afeb7247d39
-
Size
1.6MB
-
MD5
b9c033590bddd396d64df17564fae259
-
SHA1
8c2d58de29e8f6be3c081cd82be466681b5b87af
-
SHA256
089143232eed0f74efe27bb72f67acb157c583a513deba51df0a6afeb7247d39
-
SHA512
8c125af0a1bea786336179a53fad04f59d06cc5455ffbf30509c1f05249b8331b2ef5ddfeda7aad515b22c05ac6b7d663e44c166100023f3a23fa0941b3fd8e2
-
SSDEEP
24576:qctS0RSuKKOA5UoBcE7lYey8oCIfm1b+scD6VPYFSn7Yt4FikezdDUTwtm+uqUT+:q90RSRoGEg5Cb57Fikq4TwtVunAcS0I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 089143232eed0f74efe27bb72f67acb157c583a513deba51df0a6afeb7247d39
Files
-
089143232eed0f74efe27bb72f67acb157c583a513deba51df0a6afeb7247d39.exe windows:5 windows x86
1bdb095bd6f86fbc895109d4f81f8005
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetCurrentThreadId
CloseHandle
GetLocalTime
InitializeCriticalSectionAndSpinCount
Sleep
GetLastError
WaitForSingleObject
LocalFree
CreateProcessW
GetModuleHandleW
GetVersionExW
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcess
OpenProcess
SystemTimeToFileTime
GetSystemTime
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetLongPathNameW
GetFileAttributesExW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryExW
ReadFile
SetEndOfFile
GetFileSize
HeapFree
HeapAlloc
GetProcessHeap
GetDiskFreeSpaceW
InterlockedExchangeAdd
CreateDirectoryW
GetFullPathNameW
lstrlenW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
GetTempFileNameW
GetTickCount
DeviceIoControl
FormatMessageW
SetLastError
SetFilePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
GetStdHandle
GetFileType
WriteFile
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
InterlockedExchange
GetFileSizeEx
VirtualQuery
GetModuleFileNameW
GetCurrentProcessId
GetProcAddress
CreateFileW
GetStringTypeW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ