Static task
static1
Behavioral task
behavioral1
Sample
3e6524cb6e528fc5af8ef4cd347caa96.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3e6524cb6e528fc5af8ef4cd347caa96.exe
Resource
win10v2004-20231020-en
General
-
Target
3e6524cb6e528fc5af8ef4cd347caa96.exe
-
Size
970KB
-
MD5
3e6524cb6e528fc5af8ef4cd347caa96
-
SHA1
26115424c51a9c6ce67eabd55182d43ee6b856de
-
SHA256
2e107b7644bd78081818092ecd4de0cbdb4536789a2f5fe62eed7fc93a6ab516
-
SHA512
533b19bbd8c1e9adc8d25332696d88f40bc5b204fb5f12fdaffe5b36f38915fb372895d2f5814c2b7f6c1633d79dc1bf2b5b58720dac61ff1bcea892efaa8297
-
SSDEEP
12288:8zQpGFVYuIy1XF+VwHzaZS7FKikfSXLIuqcrcKIcqoFJwyKs456yDNjX6JHhB94S:8ztwy1XF+WF7FKHfEonCKsJyjX6HfH3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e6524cb6e528fc5af8ef4cd347caa96.exe
Files
-
3e6524cb6e528fc5af8ef4cd347caa96.exe.exe windows:6 windows x86
d69c4e30a35b137f9c7b5192ce2b3862
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getaddrinfo
send
WSACloseEvent
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getsockopt
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
wldap32
ord27
ord217
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord143
ord26
ord22
ord41
ord50
ord45
ord60
ord211
normaliz
IdnToUnicode
IdnToAscii
kernel32
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetLocaleInfoW
WriteConsoleW
OutputDebugStringW
GetConsoleOutputCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
GetProcessHeap
GetFileAttributesExW
SetStdHandle
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
WriteFile
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindClose
GetDriveTypeW
CreateFileW
GetSystemInfo
HeapValidate
HeapAlloc
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleFileNameW
TlsFree
TlsSetValue
TlsGetValue
GetTempPathA
GetLastError
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
FormatMessageW
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetCurrentProcessId
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
TlsAlloc
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileInformationByHandle
DeleteFileW
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
ExitProcess
GetCurrentThreadId
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
LoadLibraryExW
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
shell32
ShellExecuteA
bcrypt
BCryptGenRandom
Sections
.text Size: 761KB - Virtual size: 761KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ