Static task
static1
Behavioral task
behavioral1
Sample
b80258f3d4c075761a3b5ef774a530810003f78636397f2ca510e2265cd22a04.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b80258f3d4c075761a3b5ef774a530810003f78636397f2ca510e2265cd22a04.exe
Resource
win10v2004-20231023-en
General
-
Target
b80258f3d4c075761a3b5ef774a530810003f78636397f2ca510e2265cd22a04
-
Size
441KB
-
MD5
bb35491a7155f106153be5c2b93291ac
-
SHA1
6b48efbef6847f778bb1f03eebd8481eac800978
-
SHA256
b80258f3d4c075761a3b5ef774a530810003f78636397f2ca510e2265cd22a04
-
SHA512
207a5d3310b229631acf8bf906d3a8ab6731a52e65bd6173c0b4beed059405748f2d839336650d2191613b6a0cd6c86db30a192b4924ad534f26c7a6f5367a91
-
SSDEEP
6144:vFZubsT4SqH+1lbzaluycYnxMA3d8uFyXxPx78AOOdqVwNJti:vFZuG3pzEuycY2SyXtxQgNi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b80258f3d4c075761a3b5ef774a530810003f78636397f2ca510e2265cd22a04
Files
-
b80258f3d4c075761a3b5ef774a530810003f78636397f2ca510e2265cd22a04.exe windows:6 windows x86
08dce6791e72d21b7643723d2a8acb76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineW
lstrcmpiW
LocalFree
GetStartupInfoW
SetEndOfFile
GetFileSize
DeleteFileW
LoadLibraryExW
WriteFile
ReadFile
CreateFileW
CreateMutexW
ReleaseMutex
ResetEvent
CreateEventW
SetEvent
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
FreeLibrary
GetCurrentProcess
IsBadReadPtr
GetProcAddress
GetModuleHandleW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
GetLastError
SetUnhandledExceptionFilter
CloseHandle
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
FlushFileBuffers
MulDiv
GetACP
SetFilePointer
WaitForSingleObjectEx
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
user32
wsprintfW
SendMessageTimeoutW
IsWindow
CharNextW
FindWindowW
advapi32
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
shell32
SHGetSpecialFolderPathW
ord165
ShellExecuteExW
ole32
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleInitialize
oleaut32
VarUI4FromStr
shlwapi
StrStrIW
PathAppendW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
gdiplus
GdiplusStartup
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ