Static task
static1
Behavioral task
behavioral1
Sample
e68e993cae46742442b93761d2f29720a2fcfb37f28fffe4d4603ae31cabb49b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
e68e993cae46742442b93761d2f29720a2fcfb37f28fffe4d4603ae31cabb49b.exe
Resource
win10v2004-20231023-en
General
-
Target
e68e993cae46742442b93761d2f29720a2fcfb37f28fffe4d4603ae31cabb49b
-
Size
230KB
-
MD5
1685f42ed67e8bdf628e2b8dbd5d80ed
-
SHA1
8fdc9488c8da19dd43aef4af666669ebc5041b3c
-
SHA256
e68e993cae46742442b93761d2f29720a2fcfb37f28fffe4d4603ae31cabb49b
-
SHA512
e653ea33cc64cac3b56610c2d6c0ae6233bfcc5f6a5760b3783cf55f0896200e3a376867589bc904d3700750ff6d194795a76d6fc8806f7a79438a252b1a43fc
-
SSDEEP
6144:8kcmVSPbPIbbZ9T0wlDUiHoODsKX/iWuPY:8hUSDQ/ZPDUiVuw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e68e993cae46742442b93761d2f29720a2fcfb37f28fffe4d4603ae31cabb49b
Files
-
e68e993cae46742442b93761d2f29720a2fcfb37f28fffe4d4603ae31cabb49b.exe windows:6 windows x64
5b7ba030216aa67ecd48f8a6f49507d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
MessageBoxW
kernel32
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FindClose
FindFirstFileExA
FindNextFileA
SetStdHandle
WriteConsoleW
ReadConsoleW
HeapSize
CreateFileW
advapi32
SystemFunction036
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ