Static task
static1
Behavioral task
behavioral1
Sample
2001a61c66ebcd25c5c14ba4c8848078bb3807cb81c9020294135d91708d0078.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2001a61c66ebcd25c5c14ba4c8848078bb3807cb81c9020294135d91708d0078.exe
Resource
win10v2004-20231020-en
General
-
Target
2001a61c66ebcd25c5c14ba4c8848078bb3807cb81c9020294135d91708d0078
-
Size
3.5MB
-
MD5
71c33f14cca260ab4d46fd1d8f27fe5d
-
SHA1
bf8a3d679d323789a1ccb6b6af1b8b82598d036a
-
SHA256
2001a61c66ebcd25c5c14ba4c8848078bb3807cb81c9020294135d91708d0078
-
SHA512
5cb2377c6934c4bafb3b9623a23d399e4700f218809194a4104aba7fe0115071f9f22017f7c48c2fd850dda03dfa2fc69d7d60bc911f0f99d1a426dbe1afb681
-
SSDEEP
98304:WNXXmXJTV/wHdv8cly9y/6KK7azyIeNAgWD:knm5WTly9yWaeo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2001a61c66ebcd25c5c14ba4c8848078bb3807cb81c9020294135d91708d0078
Files
-
2001a61c66ebcd25c5c14ba4c8848078bb3807cb81c9020294135d91708d0078.exe windows:4 windows x86
7576c9f124ab5275b95b58fb328371a6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx
user32
wsprintfA
shlwapi
ord158
msvbvm60
__vbaVarTstGt
__vbaStrI2
__vbaI2Sgn
__vbaStrVarMove
__vbaRecAnsiToUni
__vbaI4Sgn
__vbaVarTextTstEq
__vbaStrDate
__vbaNameFile
__vbaVargVarCopy
__vbaLenVar
__vbaLateMemSt
__vbaStrBool
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaStrFixstr
__vbaStrTextCmp
__vbaRefVarAry
ord631
__vbaErase
__vbaLateMemStAd
__vbaVarAbs
__vbaVarLateMemSt
__vbaNew
_CIsqrt
__vbaStrUI1
ord712
__vbaR4ErrVar
_adj_fprem
__vbaI2Str
ord608
__vbaVarCmpLe
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaVarCat
__vbaDateVar
__vbaLsetFixstrFree
ord645
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
__vbaI4Str
__vbaVarNot
_adj_fdivr_m32
__vbaVarTstNe
__vbaForEachAry
__vbaLateMemCall
__vbaVarDup
__vbaFpI2
__vbaRecDestructAnsi
_CIatan
__vbaCastObj
__vbaStrVarCopy
__vbaForEachVar
__vbaVarNeg
ord650
__vbaVarLateMemCallSt
__vbaAryRecCopy
__vbaFPInt
Sections
.text Size: - Virtual size: 12.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox Size: - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vdata0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vdata1 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox3 Size: 216KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ