Static task
static1
Behavioral task
behavioral1
Sample
87a48266d7397f837f86000015922d263a1358c91318c03b5d78751d2295de26.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
87a48266d7397f837f86000015922d263a1358c91318c03b5d78751d2295de26.exe
Resource
win10v2004-20231023-en
General
-
Target
87a48266d7397f837f86000015922d263a1358c91318c03b5d78751d2295de26
-
Size
1.7MB
-
MD5
ca941991a9c520cfdcaad76b3aee2ef2
-
SHA1
d1c4f66761f230be03f05dcbe7c7a6308c25b788
-
SHA256
87a48266d7397f837f86000015922d263a1358c91318c03b5d78751d2295de26
-
SHA512
97669a3174954ced878b349e5cfb24fce03a5d95a61170cd87cd25cf185daf4d05ebfa9c5abdf18c708107557e9dcb1759d6c48afeca6674d516c9402cc5d10c
-
SSDEEP
12288:AZGcV+Ev4aumlCSRBW8NGRP4Q+Eaw8lKnJlTxIWU8DUDwFi:Sd+RmlbBW8sRPEbyJlTaN8D1o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87a48266d7397f837f86000015922d263a1358c91318c03b5d78751d2295de26
Files
-
87a48266d7397f837f86000015922d263a1358c91318c03b5d78751d2295de26.exe windows:6 windows x64
8b0dca6e8f218b7a80dd00da128bc644
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
CM_Get_Res_Des_Data_Size
CM_Get_Next_Res_Des
CM_Free_Res_Des_Handle
CM_Get_Device_IDW
CM_Get_First_Log_Conf
CM_Get_Res_Des_Data
CM_Get_DevNode_Status
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
CM_Get_Parent
kernel32
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
SizeofResource
DeviceIoControl
WaitForSingleObject
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
ProcessIdToSessionId
Process32NextW
LockResource
Process32FirstW
CloseHandle
FindResourceExW
LoadResource
FindResourceW
GetConsoleCP
WTSGetActiveConsoleSessionId
CreateProcessW
GetModuleHandleW
MultiByteToWideChar
WaitForMultipleObjects
CreateEventW
SetEvent
CreateThread
ResetEvent
GetSystemDirectoryW
Sleep
LoadLibraryW
FreeLibrary
SetWaitableTimer
EnterCriticalSection
CreateWaitableTimerW
LeaveCriticalSection
LocalAlloc
CancelWaitableTimer
LocalFree
FlushFileBuffers
GetFileType
WriteConsoleW
SetEndOfFile
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CompareStringW
GetProcAddress
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
SetStdHandle
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
IsDebuggerPresent
OutputDebugStringW
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
LCMapStringW
user32
RegisterDeviceNotificationW
UnregisterDeviceNotification
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegCreateKeyExW
RegSetValueExW
StartServiceCtrlDispatcherW
RegNotifyChangeKeyValue
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
SetTokenInformation
OpenProcessToken
RegOpenKeyExW
CreateProcessAsUserW
DuplicateTokenEx
RegQueryValueExW
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
PropVariantClear
oleaut32
SysAllocString
VariantInit
SafeArrayAccessData
VariantChangeType
VariantClear
SafeArrayUnaccessData
SysFreeString
Sections
.text Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.5MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE