Static task
static1
Behavioral task
behavioral1
Sample
2dd0699c3109a3e458ac642b7980743ab5c6fc7f1d1a9486bfeba959a5d862d3.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2dd0699c3109a3e458ac642b7980743ab5c6fc7f1d1a9486bfeba959a5d862d3.exe
Resource
win10v2004-20231025-en
General
-
Target
2dd0699c3109a3e458ac642b7980743ab5c6fc7f1d1a9486bfeba959a5d862d3
-
Size
124KB
-
MD5
6d9c04b4a5c2cf9604351c13bbfa7bfc
-
SHA1
dbf7e686c24a0d2f9de09ce8de5241ccdbf4a1f0
-
SHA256
2dd0699c3109a3e458ac642b7980743ab5c6fc7f1d1a9486bfeba959a5d862d3
-
SHA512
947e19f89f65345e838785d196edc8f079560033d6c164530657c64de1cbea7581528eddcf22fd247f05cfde0155ca11c12f173e873fe8b5b074cdd4d5b76a9a
-
SSDEEP
3072:uYlkyF5tTe6gOYPY95qrB5gpwkG2XGIOVHlU7H3v1/MACubCdlKjs54nntspSnf2:uYlrF5tTe6gOYPY95qrB5gpwkG2XGIOR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dd0699c3109a3e458ac642b7980743ab5c6fc7f1d1a9486bfeba959a5d862d3
Files
-
2dd0699c3109a3e458ac642b7980743ab5c6fc7f1d1a9486bfeba959a5d862d3.exe windows:5 windows x86
d387493f99c7a70591c9f021eca7caf7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
dnsapi
DnsFlushResolverCache
DnsGetCacheDataTable
DnsQuery_W
DnsRecordListFree
iphlpapi
GetAdaptersInfo
GetIfEntry
GetInterfaceInfo
GetNetworkParams
GetPerAdapterInfo
IpReleaseAddress
IpRenewAddress
kernel32
DeleteCriticalSection
EnterCriticalSection
FindResourceA
FormatMessageA
GetComputerNameExA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
QueryPerformanceCounter
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
lstrcmpA
lstrlenA
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_iob
_lock
_onexit
_stricmp
_strnicmp
_unlock
abort
asctime
calloc
exit
fprintf
free
fwrite
localtime
malloc
memmove
printf
putchar
puts
signal
sprintf
strncmp
vfprintf
user32
CharToOemA
LoadStringA
wsprintfA
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rossym Size: 27KB - Virtual size: 27KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ