Static task
static1
Behavioral task
behavioral1
Sample
d1437f65d2520fa2afb7860f48f2825a71fd6af7183c2d0aac9f4394d85ad599.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
d1437f65d2520fa2afb7860f48f2825a71fd6af7183c2d0aac9f4394d85ad599.exe
Resource
win10v2004-20231020-en
General
-
Target
d1437f65d2520fa2afb7860f48f2825a71fd6af7183c2d0aac9f4394d85ad599
-
Size
335KB
-
MD5
e1418cab6b15ebae93d1d0b9dba3eb78
-
SHA1
f6322f9207779822cc22e533577360e0354d7ca4
-
SHA256
d1437f65d2520fa2afb7860f48f2825a71fd6af7183c2d0aac9f4394d85ad599
-
SHA512
825aaae5167f153d3a3e89bf0b2895a3e8cb4b344871ab3b65759ca09cd22a0cfdaadf0bc6262f1b1b6c79511a4b2ad5827c207c78a4276aeb25e514a6c5a4e2
-
SSDEEP
6144:Xdzcf6oZtnNM4hDLlxB0T7Cifng3OvVDlEqazE/TXw7IoCYR/xpO7GpY0Nt:XdzcNZtnaAevVDl7ag/Lw7EuxpOiplt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1437f65d2520fa2afb7860f48f2825a71fd6af7183c2d0aac9f4394d85ad599
Files
-
d1437f65d2520fa2afb7860f48f2825a71fd6af7183c2d0aac9f4394d85ad599.exe windows:6 windows x86
c02c02c9487a95cb600abe09e60344ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringA
GetModuleHandleW
lstrcpyW
GetPrivateProfileStringA
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
GetProcessHeap
LCMapStringW
MapViewOfFile
GetStringTypeW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapAlloc
HeapFree
CreateFileMappingW
WideCharToMultiByte
GetCurrentProcessId
CloseHandle
lstrcpyA
SetEvent
MultiByteToWideChar
CreateEventW
TerminateProcess
UnmapViewOfFile
HeapReAlloc
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
DecodePointer
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
user32
LoadCursorW
SystemParametersInfoW
TranslateMessage
TranslateAcceleratorW
DrawTextExW
wsprintfW
PostQuitMessage
UpdateWindow
LoadImageW
BeginPaint
InvalidateRect
EndPaint
LoadIconW
MessageBoxA
EndDialog
GetWindowTextA
MapWindowPoints
SetWindowTextA
LoadBitmapW
GetClientRect
GetDlgItem
GetWindowTextLengthA
GetMessageW
DefWindowProcW
DestroyWindow
MessageBoxW
CreateWindowExW
SendMessageW
RegisterClassExW
LoadAcceleratorsW
LoadStringW
wsprintfA
ShowWindow
DispatchMessageW
DialogBoxParamW
gdi32
SetBkMode
BitBlt
SelectObject
CreateCompatibleDC
GetStockObject
DeleteDC
SetTextColor
SetBkColor
DeleteObject
advapi32
RegGetValueW
shell32
ShellExecuteExW
SHGetSpecialFolderPathA
shlwapi
StrChrA
StrChrW
PathFileExistsW
ws2_32
htonl
ntohl
htons
inet_ntop
recv
connect
ntohs
send
WSAStartup
WSAAsyncSelect
gethostbyname
closesocket
WSACleanup
socket
Sections
.text Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 253KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ