Static task
static1
Behavioral task
behavioral1
Sample
413e614e8af806efe4d999adfe258aee95da3cfec2683cbaee8e2cd0a44f3a72.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
413e614e8af806efe4d999adfe258aee95da3cfec2683cbaee8e2cd0a44f3a72.exe
Resource
win10v2004-20231025-en
General
-
Target
413e614e8af806efe4d999adfe258aee95da3cfec2683cbaee8e2cd0a44f3a72
-
Size
1.6MB
-
MD5
563f976f58b3379e77a09c54088bffee
-
SHA1
6421150844fbcce9a3eab4b8c4779ba2e6c46359
-
SHA256
413e614e8af806efe4d999adfe258aee95da3cfec2683cbaee8e2cd0a44f3a72
-
SHA512
b74c2b9216b85d66b9502b06abf430f97c8267e4888d0c586157a4dfe5fc6a7a56be046fe945a7d4c8c9251d9c16e8006088299755fe8802e1f468449d25e57c
-
SSDEEP
24576:aAtS0RSuKKOA5UoBcE7lYey8oCIfm1b+scD6VPYFSn7Yt4FnkezdDQTwtu3bqUTH:a50RSRoGEg5Cb57FnkqETwt4bnAcS0Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 413e614e8af806efe4d999adfe258aee95da3cfec2683cbaee8e2cd0a44f3a72
Files
-
413e614e8af806efe4d999adfe258aee95da3cfec2683cbaee8e2cd0a44f3a72.exe windows:5 windows x86
1bdb095bd6f86fbc895109d4f81f8005
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetCurrentThreadId
CloseHandle
GetLocalTime
InitializeCriticalSectionAndSpinCount
Sleep
GetLastError
WaitForSingleObject
LocalFree
CreateProcessW
GetModuleHandleW
GetVersionExW
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentProcess
OpenProcess
SystemTimeToFileTime
GetSystemTime
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetLongPathNameW
GetFileAttributesExW
CreateMutexW
ReleaseMutex
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryExW
ReadFile
SetEndOfFile
GetFileSize
HeapFree
HeapAlloc
GetProcessHeap
GetDiskFreeSpaceW
InterlockedExchangeAdd
CreateDirectoryW
GetFullPathNameW
lstrlenW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
GetTempFileNameW
GetTickCount
DeviceIoControl
FormatMessageW
SetLastError
SetFilePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
AreFileApisANSI
HeapCreate
InterlockedCompareExchange
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
GetStdHandle
GetFileType
WriteFile
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
InterlockedExchange
GetFileSizeEx
VirtualQuery
GetModuleFileNameW
GetCurrentProcessId
GetProcAddress
CreateFileW
GetStringTypeW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ