Static task
static1
Behavioral task
behavioral1
Sample
1fb7258ecc34995891efc45ad1fa45a4eb701fde9bab4ba88cfb0710d27724be.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
1fb7258ecc34995891efc45ad1fa45a4eb701fde9bab4ba88cfb0710d27724be.exe
Resource
win10v2004-20231023-en
General
-
Target
1fb7258ecc34995891efc45ad1fa45a4eb701fde9bab4ba88cfb0710d27724be
-
Size
593KB
-
MD5
2d039d347aa25ee14bbd60ee1fffb2b9
-
SHA1
0f2b461c4a15ffe2b32822568959fcaded4ff052
-
SHA256
1fb7258ecc34995891efc45ad1fa45a4eb701fde9bab4ba88cfb0710d27724be
-
SHA512
18cb060d22aa94b5b8a9e23da3ebd3349deede3addffe3583fefa963026ebd2df5136cadc5534a679f3c18ba18356d1a1e4d3cdbf68dc54c4e033644e106a0f8
-
SSDEEP
12288:8K82gxrJb0PqJ1mRYHZ2ogHcJGLRNeqfI6v6fLoGmRv/3PIY6X6Ly+Afd:0Jb0p9lv63mRv/gYNLy+A1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1fb7258ecc34995891efc45ad1fa45a4eb701fde9bab4ba88cfb0710d27724be
Files
-
1fb7258ecc34995891efc45ad1fa45a4eb701fde9bab4ba88cfb0710d27724be.exe windows:5 windows x86
a78658390d8b077fb0d415e105d3ff63
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
send
WSAGetLastError
WSACreateEvent
WSAResetEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACloseEvent
recv
WSAIoctl
setsockopt
getsockname
ntohs
bind
htons
getsockopt
getpeername
socket
connect
WSASetLastError
accept
listen
htonl
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
WSAStartup
getaddrinfo
freeaddrinfo
closesocket
WSACleanup
kernel32
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
SetLastError
GetModuleHandleA
TerminateProcess
FileTimeToLocalFileTime
CreateThread
ExitThread
CloseHandle
FileTimeToSystemTime
GetCurrentThreadId
GetLastError
FindFirstFileA
FindClose
Sleep
WritePrivateProfileStringA
GetSystemDirectoryA
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
MoveFileExA
WaitForMultipleObjects
PeekNamedPipe
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
lstrlenA
GetPrivateProfileSectionA
GetPrivateProfileIntA
WritePrivateProfileSectionA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeleteFileA
GetDriveTypeA
GetFileAttributesA
GetFileInformationByHandle
GetFullPathNameA
WaitForSingleObject
SleepEx
QueryPerformanceFrequency
FormatMessageW
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryA
GetDateFormatA
GetTimeFormatA
HeapSize
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
VirtualAlloc
VirtualFree
HeapCreate
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetFileType
GetStdHandle
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
RtlUnwind
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetStartupInfoA
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
user32
DefWindowProcA
DispatchMessageA
RegisterClassExA
TranslateMessage
GetMessageA
DestroyWindow
PostQuitMessage
CreateWindowExA
wsprintfA
PostMessageA
advapi32
CryptEncrypt
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
CryptImportKey
crypt32
CertFreeCertificateContext
PFXImportCertStore
CertFindCertificateInStore
CertCloseStore
CryptStringToBinaryA
CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptQueryObject
CryptDecodeObjectEx
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCreateCertificateChainEngine
wldap32
ord45
ord60
ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord22
ord211
ord217
ord143
ord50
ord26
ord200
ord30
Sections
.text Size: 442KB - Virtual size: 441KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ