Static task
static1
Behavioral task
behavioral1
Sample
payload.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
payload.exe
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
payload.exe
Resource
win10v2004-20231020-en
General
-
Target
payload
-
Size
9.0MB
-
MD5
f6c5df8944a965d0d3aa2e124a1935af
-
SHA1
3ff36a13827d193a85eed40b59646bad1d676986
-
SHA256
41554c195bc8c87ddb8bbeacefe77c033f56549a03361dd76c2243546dd1f2d8
-
SHA512
8d75df03c33e9288b2d4b9e941c89ca2e0e7008e151ee3c104292427266043050f9966d0ff6e5c46890bde404337873768a4cde255778418144766646d08ceae
-
SSDEEP
196608:cTEcVnJULKrytYcJX7Nfjw9cI1qyz+6weSn5NeCX4X6:4EcVnukcJLtlIwqwemrePX6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource payload
Files
-
payload.exe windows:6 windows x64
ccb2cf295a891890865d88d1e63e8f2c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
SysFreeString
kernel32
GetCurrentThread
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
crypt32
CertDuplicateStore
ole32
CoInitializeSecurity
advapi32
RegQueryValueExW
user32
EnumDisplaySettingsExW
gdi32
SetStretchBltMode
bcrypt
BCryptCloseAlgorithmProvider
ws2_32
WSASend
ntdll
RtlNtStatusToDosError
secur32
EncryptMessage
vcruntime140
__C_specific_handler
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-runtime-l1-1-0
_endthreadex
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 756KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KBU Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1Ts Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VdS Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 433KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ