Static task
static1
Behavioral task
behavioral1
Sample
81297278afa7f583194c00956dcb53992ebfb10f790d12fa579c7f3dd125d4e4.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
81297278afa7f583194c00956dcb53992ebfb10f790d12fa579c7f3dd125d4e4.exe
Resource
win10v2004-20231023-en
General
-
Target
81297278afa7f583194c00956dcb53992ebfb10f790d12fa579c7f3dd125d4e4
-
Size
452KB
-
MD5
6f28abff431ad54e7bc8b5a4684b7ae0
-
SHA1
ac611b5c0f99525bb06b441f83b3b03b31668ff4
-
SHA256
81297278afa7f583194c00956dcb53992ebfb10f790d12fa579c7f3dd125d4e4
-
SHA512
b5ed942dbc482214bec2dd4d8a686ff7410bfe96a77810aab9d76db0e148432757f95b19ffa5960eb5254d54e0b8081eec88607e9e3ee840d44293f73d9338a2
-
SSDEEP
6144:Ig5Nbz5XbkZ+/WaqaqpblD3wTW7Xe4Ohp6u9urP7omhoYkWYCd:Ig5NF6+//qpbh3wTWr8hUkQsWYO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81297278afa7f583194c00956dcb53992ebfb10f790d12fa579c7f3dd125d4e4
Files
-
81297278afa7f583194c00956dcb53992ebfb10f790d12fa579c7f3dd125d4e4.exe windows:4 windows x86
3e9e2513dda48020446430bab9e7cc53
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlMoveMemory
LocalSize
MultiByteToWideChar
GetACP
GetStartupInfoA
GetModuleHandleA
CreateThread
DeleteCriticalSection
TerminateThread
CloseHandle
WaitForSingleObject
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntryA
ole32
CoTaskMemAlloc
wmvert
wm_PostMessage
wm_pstr
wm_Str
wm_GetBinData
wm_ReadFile
wm_GetTempFileName
wm_WriteMem
wm_Len
wm_ToInt
wm_Left
wm_CreateWindowFromTemplate
wm_MsgBox
wm_RpSubText
wm_InStr
wm_Split
wm_Destroy
wm_Run
wm_GotoInternet
wm_Sleep
wm_Kill
wm_GetRunPath
wm_UpdateWindow
wm_NotifySys
wm_BOr
wm_pbin
wm_GetTickCount
wm_GetCmdLine
wm_InStrRev
wm_Right
msvcrt
_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
free
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 404KB - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ