Static task
static1
Behavioral task
behavioral1
Sample
aa8ee2c01eae13ea6ddda3e466f82e6fa5b300c100e844e617af8e807d74a411.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
aa8ee2c01eae13ea6ddda3e466f82e6fa5b300c100e844e617af8e807d74a411.exe
Resource
win10v2004-20231023-en
General
-
Target
aa8ee2c01eae13ea6ddda3e466f82e6fa5b300c100e844e617af8e807d74a411
-
Size
9KB
-
MD5
8d484d33d1348091c1c97749ab82d0e6
-
SHA1
55458c6bf7661739840fa1b4ad5e60ab73ca5d66
-
SHA256
aa8ee2c01eae13ea6ddda3e466f82e6fa5b300c100e844e617af8e807d74a411
-
SHA512
5803d207ed75e0b8cf2b3236a9df4d2a4ff3f35648b21eceb18de11af0c7b79d135f1809b8ed8555e3d0bcabb37f45435f60b6fad873eef09c8e47cf38079e43
-
SSDEEP
96:AGsJxHe9x1PgdkSdKtNFupfJuRX2mnKlXftwLnLQkcax+:9aHWRgdkSMz0AYY8wjjcb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa8ee2c01eae13ea6ddda3e466f82e6fa5b300c100e844e617af8e807d74a411
Files
-
aa8ee2c01eae13ea6ddda3e466f82e6fa5b300c100e844e617af8e807d74a411.exe windows:6 windows x64
7fb21d1c7af34cd3b6fd672d2aca3759
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCommandLineW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
CreateRemoteThread
GetExitCodeThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
shell32
CommandLineToArgvW
ntdll
NtAllocateVirtualMemory
memcpy
NtFreeVirtualMemory
LdrProcessRelocationBlock
LdrGetProcedureAddress
LdrLoadDll
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
wcscpy_s
LdrUnloadDll
RtlImageNtHeader
swscanf_s
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ