Static task
static1
Behavioral task
behavioral1
Sample
f504e562c6288bfbb91cbdd5c130d5e001588f24768e97fbd4826faa26c92f89.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
f504e562c6288bfbb91cbdd5c130d5e001588f24768e97fbd4826faa26c92f89.exe
Resource
win10v2004-20231020-en
General
-
Target
f504e562c6288bfbb91cbdd5c130d5e001588f24768e97fbd4826faa26c92f89
-
Size
9KB
-
MD5
dd32fb94184f394aa36638cc307c4fd4
-
SHA1
b75fd4d31d5f4f2afc2b9001e867590be94a9e7f
-
SHA256
f504e562c6288bfbb91cbdd5c130d5e001588f24768e97fbd4826faa26c92f89
-
SHA512
7eafc9aff42ab6889c313d2e3aba8ec53d3489216b61ed42333e9eeef54b66db480a9277edfa0d0a32f20ad4e4ab9e1ebc443939602d8ad031f4c8475b6b22fc
-
SSDEEP
96:e153v/PrHhZ1SzggcYr0TBKtcaKgv85mLDx43HtwLnLdkcPx:e15fLH/1SzMYr0Yaay52DxGNwjmc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f504e562c6288bfbb91cbdd5c130d5e001588f24768e97fbd4826faa26c92f89
Files
-
f504e562c6288bfbb91cbdd5c130d5e001588f24768e97fbd4826faa26c92f89.exe windows:6 windows x64
d4b1fcf94ddb7bb931932a30a884e102
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCommandLineW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
GetCurrentProcess
GetCurrentProcessId
CreateRemoteThread
GetExitCodeThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
GetCurrentThreadId
QueryPerformanceCounter
shell32
CommandLineToArgvW
ntdll
NtAllocateVirtualMemory
NtQueryVirtualMemory
memcpy
NtProtectVirtualMemory
LdrProcessRelocationBlock
LdrUnloadDll
LdrGetProcedureAddress
swscanf_s
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
wcscpy_s
NtFreeVirtualMemory
RtlImageNtHeader
LdrLoadDll
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ