Static task
static1
Behavioral task
behavioral1
Sample
6c74a73404b5443ea79efc9087eff52f2654ec5053a30d434b45aa50deac1845.exe
Resource
win7-20231023-en
General
-
Target
6c74a73404b5443ea79efc9087eff52f2654ec5053a30d434b45aa50deac1845
-
Size
1.5MB
-
MD5
5e69e860a1ae5d43524afbcd8f282ab6
-
SHA1
2d689e98d6327dfddffff9d6d4b45d199c4cfc3b
-
SHA256
6c74a73404b5443ea79efc9087eff52f2654ec5053a30d434b45aa50deac1845
-
SHA512
49d584e4292b31813d61808f40f60536e5308afbc37aa1ca29e6e4300afaf28c9934cb14b5105c00d965fa4ff6df6823a00ea9fe19f1fe9120f14509da85c456
-
SSDEEP
24576:3FDazRRGNPtSKavWqDnuwsqjnhMgeiCl7G0nehbGZpbD:Y/GbSKaZ7Dmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c74a73404b5443ea79efc9087eff52f2654ec5053a30d434b45aa50deac1845
Files
-
6c74a73404b5443ea79efc9087eff52f2654ec5053a30d434b45aa50deac1845.exe windows:5 windows x86
544b9917ae2cfcb48629d51ebd18a47b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAGetLastError
bind
WSASocketA
WSAIoctl
WSARecv
WSASend
closesocket
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
kernel32
QueryPerformanceCounter
CreateIoCompletionPort
GetQueuedCompletionStatus
CloseHandle
QueryPerformanceFrequency
PostQueuedCompletionStatus
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryDepthSList
GetLastError
WriteFile
ReadFile
DeviceIoControl
CreateFileA
CancelIo
InterlockedPopEntrySList
ReleaseSemaphore
UnregisterWaitEx
LoadLibraryW
SetConsoleCtrlHandler
FreeLibrary
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
UnmapViewOfFile
GetFileAttributesA
OpenFileMappingA
MapViewOfFile
WaitForSingleObject
OpenMutexA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetProcAddress
WideCharToMultiByte
EncodePointer
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
MultiByteToWideChar
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapFree
CreateThread
ExitThread
FreeLibraryAndExitThread
CompareStringW
LCMapStringW
GetFileType
GetConsoleMode
ReadConsoleW
HeapReAlloc
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleCP
CreateFileW
SetFilePointerEx
HeapSize
WriteConsoleW
SetEndOfFile
DecodePointer
CreateTimerQueue
SetEvent
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
user32
GetDesktopWindow
MessageBoxA
advapi32
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
shlwapi
PathFileExistsA
Sections
.text Size: 276KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE