Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231025-en
General
-
Target
file.exe
-
Size
313KB
-
MD5
dd016453b135f5398e47f1303878fd70
-
SHA1
cca7d84833a744051e53fff09c3c5310607b5862
-
SHA256
380edb414750f511e72ad11116e24b9dc1888350ac13ca6d0cf0bbdc1baec4df
-
SHA512
c1f1d743bc7fd0efb61760e6eb03cb54c1086d8da7dc62fc024821340b2c042d3796a0e93182ac8bbc196ac9d8ac2e99f856d8744ba98eaac822b0ff4d700bb3
-
SSDEEP
6144:G1ruzEZqYcVcb4O9FjYhy5ZsAfT/4MqBVpjF:G1rGEkYOwh9x43BVlF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:6 windows x86
f10e6c73570373c7838a7eb72b40b9c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
RestoreDC
user32
RegisterShellHookWindow
InflateRect
IsWindowVisible
GetPointerDeviceRects
GetGestureInfo
EnableMouseInPointer
SetDoubleClickTime
GetProcessWindowStation
ValidateRgn
advapi32
InitializeAcl
MapGenericMask
comctl32
ImageList_Read
ord3
kernel32
GetConsoleMode
HeapReAlloc
FlushFileBuffers
GetProcessHeap
CreateFileW
WriteConsoleW
HeapSize
GetConsoleOutputCP
FreeConsole
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
Sleep
GetCurrentThreadId
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
RaiseException
RtlUnwind
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
DecodePointer
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bSs Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bSS Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ