Static task
static1
Behavioral task
behavioral1
Sample
ef72d92351b45f693b1bee2b69aaca87e9c2ec5c769e7d4f8ba6302d4c0e65a3.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ef72d92351b45f693b1bee2b69aaca87e9c2ec5c769e7d4f8ba6302d4c0e65a3.exe
Resource
win10v2004-20231020-en
General
-
Target
ef72d92351b45f693b1bee2b69aaca87e9c2ec5c769e7d4f8ba6302d4c0e65a3
-
Size
128KB
-
MD5
ce14ccfc5026365e7b5d4072d4c05c0f
-
SHA1
fa77f5104a908f05454c655ad96744a003a094f5
-
SHA256
ef72d92351b45f693b1bee2b69aaca87e9c2ec5c769e7d4f8ba6302d4c0e65a3
-
SHA512
649fa8ce3f6e07867488f95d1274ca5c75c1e8458a8e99608db40cb6d7c6400c636525cdac3650d1f890a1a5e9b6c236969858b75f567b7f460ac68d1b191aad
-
SSDEEP
1536:ARHg2VkN9fukSaErDY1TpyjPHoGP/eSMHl/+OtYFX3h4eDz1oIV+jg5xcgAGawqn:Sq9xG/YTybL+DNt4nicT3awqQCoxc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef72d92351b45f693b1bee2b69aaca87e9c2ec5c769e7d4f8ba6302d4c0e65a3
Files
-
ef72d92351b45f693b1bee2b69aaca87e9c2ec5c769e7d4f8ba6302d4c0e65a3.exe windows:5 windows x86
4e728483442719b19ff6ed0d82061df8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileW
FindClose
GetModuleFileNameW
GetStartupInfoW
CloseHandle
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
CreateProcessW
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
user32
SendMessageW
ReleaseDC
GetDC
FindWindowW
gdi32
GetDeviceCaps
vcruntime140
wcsrchr
memset
_except_handler4_common
_CxxThrowException
__std_exception_destroy
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
_initterm
_initterm_e
_exit
_get_wide_winmain_command_line
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_configure_wide_argv
_c_exit
_set_app_type
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_seh_filter_exe
__p___wargv
__p___argc
exit
_cexit
api-ms-win-crt-string-l1-1-0
wcsncmp
wcslen
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__p__commode
_set_fmode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 69KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE