Static task
static1
Behavioral task
behavioral1
Sample
1c799d696e57c9ab1c0036a94840c0fa8f11e9c67ef2b5662c65ef8c29c8a703.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
1c799d696e57c9ab1c0036a94840c0fa8f11e9c67ef2b5662c65ef8c29c8a703.exe
Resource
win10v2004-20231023-en
General
-
Target
1c799d696e57c9ab1c0036a94840c0fa8f11e9c67ef2b5662c65ef8c29c8a703
-
Size
701KB
-
MD5
9e1bfbaefff859deab130e6bd17eea91
-
SHA1
a1ffc059a9e4a5db9995d054deca1f620f549d8a
-
SHA256
1c799d696e57c9ab1c0036a94840c0fa8f11e9c67ef2b5662c65ef8c29c8a703
-
SHA512
6e0fd511e6d2139a8830cbd177f36a42a7ace13c2ae9ac9b94586107b0d2d6107fb45f8247779c2749a3ed2c7cf824d4602031a50a0daecb240cdf8de5a8acd6
-
SSDEEP
6144:5+hi0nv1dObN+8bfLmyRL2yg3m147pmbbg4O1NpVC48xEfEIRCkvGodaX2aEH9DC:4vmbN+8jqh33mqpmbb3OxxnlmXWHd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c799d696e57c9ab1c0036a94840c0fa8f11e9c67ef2b5662c65ef8c29c8a703
Files
-
1c799d696e57c9ab1c0036a94840c0fa8f11e9c67ef2b5662c65ef8c29c8a703.exe windows:6 windows x64
8be42b14aeb261b078d2d674bb071f88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalFree
CloseHandle
LoadLibraryW
LoadResource
FindResourceW
GetProcAddress
GlobalLock
GetModuleHandleW
WideCharToMultiByte
ReadFile
SetLastError
WriteFile
CreateFileW
GetCurrentThreadId
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
GlobalAlloc
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
SetEvent
CreateTimerQueue
WriteConsoleW
HeapSize
FlushFileBuffers
GetConsoleCP
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetStringTypeW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
LockResource
GetLastError
Sleep
MultiByteToWideChar
GetFileAttributesW
CreateMutexA
GetModuleFileNameW
OutputDebugStringA
SizeofResource
DeleteTimerQueueTimer
LCMapStringW
GetFileType
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
HeapAlloc
HeapFree
CreateThread
ExitThread
FreeLibraryAndExitThread
DecodePointer
user32
EnumDisplayMonitors
GetMonitorInfoW
GetWindowLongW
GetWindowThreadProcessId
DefWindowProcW
GetWindowRect
GetFocus
GetDC
GetPropW
SetWindowLongPtrW
CreateWindowExW
ScreenToClient
SendMessageW
RemovePropW
SetWindowTextW
ShowWindow
DispatchMessageW
SetTimer
PeekMessageW
RegisterClassW
MessageBoxA
MoveWindow
IntersectRect
SetFocus
SetPropW
TranslateMessage
SetCapture
GetClientRect
UpdateLayeredWindow
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
FindWindowExW
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
SetBitmapBits
GetObjectW
DeleteObject
GetCurrentObject
shell32
ShellExecuteA
Sections
.text Size: 404KB - Virtual size: 403KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 41B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ