Static task
static1
Behavioral task
behavioral1
Sample
70970812ad66184df31ff56165288503b82549f9f70d6ab28ab7f21272f5bd04.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
70970812ad66184df31ff56165288503b82549f9f70d6ab28ab7f21272f5bd04.exe
Resource
win10v2004-20231023-en
General
-
Target
70970812ad66184df31ff56165288503b82549f9f70d6ab28ab7f21272f5bd04
-
Size
1.0MB
-
MD5
6a0a6f7dc9caa8a016058622e60f1826
-
SHA1
3f65315ff18d7eac3d781757deada97638f9ff0b
-
SHA256
70970812ad66184df31ff56165288503b82549f9f70d6ab28ab7f21272f5bd04
-
SHA512
d6beddac2e03d3188a7943d4e337eade29fd08769a8c0eb34e3f05082a34c0a4cb238097f70546014eca123949e68b9a9b1e7fc226570532f9ad27e60c6abf2a
-
SSDEEP
24576:RedlUG6A+tHUg2vwrdF3FNJUgXoPtJKm0C1tUSbtJpE:/5JAwZF3xUgXZSbtJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70970812ad66184df31ff56165288503b82549f9f70d6ab28ab7f21272f5bd04
Files
-
70970812ad66184df31ff56165288503b82549f9f70d6ab28ab7f21272f5bd04.exe windows:6 windows x64
4427ecb33587083d600fa1b97a43dcc5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
rpcrt4
RpcStringFreeW
UuidToStringW
msi
ord195
ord109
kernel32
MultiByteToWideChar
Sleep
WideCharToMultiByte
RemoveDirectoryW
DeleteFileW
WaitForSingleObject
CloseHandle
GetCurrentProcess
GetNativeSystemInfo
GetProcAddress
FreeLibrary
IsWow64Process
CreateDirectoryW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
GetLastError
CopyFileW
GetTempFileNameW
GetModuleHandleExW
GetSystemDirectoryW
LoadLibraryA
LoadLibraryW
SetDllDirectoryW
GetCommandLineW
OpenProcess
GetCurrentProcessId
CreateProcessW
WaitForMultipleObjects
CreateMutexW
ReleaseMutex
UnmapViewOfFile
CreateEventW
SetEvent
CreateFileMappingW
MapViewOfFile
EnumSystemLocalesW
WriteConsoleW
HeapSize
CreateFileW
ReadConsoleW
SetStdHandle
SetEndOfFile
ReadFile
SetFilePointerEx
GetProcessHeap
ExpandEnvironmentStringsW
TlsSetValue
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetUserDefaultLCID
IsValidLocale
FindClose
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
LocalFree
RtlUnwindEx
RtlPcToFileHeader
RaiseException
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleFileNameA
GetStdHandle
WriteFile
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
user32
PeekMessageW
TranslateMessage
EnableWindow
DispatchMessageW
AllowSetForegroundWindow
advapi32
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
shell32
CommandLineToArgvW
ole32
CoCreateGuid
oleaut32
VariantClear
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE