Static task
static1
Behavioral task
behavioral1
Sample
2a9d4b2ec737b356f4fc78e995f5d34a0c0eb5784683741c87d5d652d7deb98f.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2a9d4b2ec737b356f4fc78e995f5d34a0c0eb5784683741c87d5d652d7deb98f.exe
Resource
win10v2004-20231020-en
General
-
Target
2a9d4b2ec737b356f4fc78e995f5d34a0c0eb5784683741c87d5d652d7deb98f
-
Size
1.6MB
-
MD5
881911c56b67c0aaa3e130b751054c09
-
SHA1
2ad0b394e485baa1dd9268bba9adf72e747ed7eb
-
SHA256
2a9d4b2ec737b356f4fc78e995f5d34a0c0eb5784683741c87d5d652d7deb98f
-
SHA512
1fd2b70e98a4f8fe1d53c56c4290c8f0236eff791861347a97522162eed69c31d2c5e6bb50e48fe64b711fc9e164886edb04b700673c0a2a87abc6375997625d
-
SSDEEP
24576:rOtS0RSuKKOA5UoBcE7lYey8oCIfm1b+scD6VPYFSn7Yt4FikezdDUTwtOMXqUTk:r70RSRoGEg5Cb57Fikq4Twt3XnAcS0e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a9d4b2ec737b356f4fc78e995f5d34a0c0eb5784683741c87d5d652d7deb98f
Files
-
2a9d4b2ec737b356f4fc78e995f5d34a0c0eb5784683741c87d5d652d7deb98f.exe windows:5 windows x86
1bdb095bd6f86fbc895109d4f81f8005
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetCurrentThreadId
CloseHandle
GetLocalTime
InitializeCriticalSectionAndSpinCount
Sleep
GetLastError
WaitForSingleObject
LocalFree
CreateProcessW
GetModuleHandleW
GetVersionExW
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcess
OpenProcess
SystemTimeToFileTime
GetSystemTime
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetLongPathNameW
GetFileAttributesExW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryExW
ReadFile
SetEndOfFile
GetFileSize
HeapFree
HeapAlloc
GetProcessHeap
GetDiskFreeSpaceW
InterlockedExchangeAdd
CreateDirectoryW
GetFullPathNameW
lstrlenW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
GetTempFileNameW
GetTickCount
DeviceIoControl
FormatMessageW
SetLastError
SetFilePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
GetStdHandle
GetFileType
WriteFile
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
InterlockedExchange
GetFileSizeEx
VirtualQuery
GetModuleFileNameW
GetCurrentProcessId
GetProcAddress
CreateFileW
GetStringTypeW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ