Static task
static1
Behavioral task
behavioral1
Sample
8e4c22c0e7e7534fc4c0df3175689758762b95574b3857fbd748542d10a17003.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
8e4c22c0e7e7534fc4c0df3175689758762b95574b3857fbd748542d10a17003.exe
Resource
win10v2004-20231023-en
General
-
Target
927b065d2380a23df01ce57dbd6d6031.bin
-
Size
1.3MB
-
MD5
b915dac3e9265135b2ea8fc672b01cc1
-
SHA1
8d4b06bf2d9027408e778c0ecebbd11a3707f34f
-
SHA256
ce53a30bbaeec51317696407cf38725bb7b7daaaf63901286167afb267348821
-
SHA512
95a8d17e207718fffaf34a8f41adda6e0eaac115bc184a5e90bc1481b10d1f8dae54334e26e368a2a7f33a3742ed2e1bf777a8946d61d1a3cbbbc09be76447ad
-
SSDEEP
24576:r9qiKqtMhH5od/UA1CKj1cS/pDtBRJ7uMJTsLdNAJ:rUiKij+A1CKu6fiMEAJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/8e4c22c0e7e7534fc4c0df3175689758762b95574b3857fbd748542d10a17003.exe
Files
-
927b065d2380a23df01ce57dbd6d6031.bin.zip
Password: infected
-
8e4c22c0e7e7534fc4c0df3175689758762b95574b3857fbd748542d10a17003.exe.exe windows:5 windows x86
Password: infected
698dbac549bac9f868447592054c90b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
secur32
AcquireCredentialsHandleA
FreeContextBuffer
DeleteSecurityContext
CompleteAuthToken
InitializeSecurityContextA
FreeCredentialsHandle
QuerySecurityPackageInfoA
kernel32
InterlockedExchange
InterlockedExchangeAdd
InterlockedCompareExchange
GetCurrentProcessId
GetCurrentThreadId
GetLastError
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ReleaseMutex
WaitForSingleObject
CloseHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SleepEx
CreateMutexW
CreateEventW
CreateWaitableTimerA
SetWaitableTimer
VerSetConditionMask
GetCurrentProcess
TerminateProcess
TerminateThread
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
QueueUserAPC
WaitForMultipleObjects
Sleep
WriteFile
ReadFile
DuplicateHandle
CreateProcessA
CreateFileA
CreateNamedPipeA
VerifyVersionInfoA
GetSystemTimeAsFileTime
GetStdHandle
GetTimeZoneInformation
OutputDebugStringA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleA
MultiByteToWideChar
InterlockedDecrement
ExitThread
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
GetModuleHandleW
GetProcAddress
LCMapStringW
AreFileApisANSI
WideCharToMultiByte
GetSystemTime
SystemTimeToFileTime
GetFileType
GetModuleHandleA
FindNextFileA
QueryPerformanceCounter
GetTickCount
FreeLibrary
LoadLibraryA
GlobalMemoryStatus
FlushConsoleInputBuffer
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
InterlockedIncrement
HeapSize
LoadLibraryW
RaiseException
FormatMessageA
RtlUnwind
UnregisterWaitEx
QueryDepthSList
GetModuleHandleExW
LocalFree
IsValidCodePage
FindFirstFileExA
GetProcessHeap
InterlockedFlushSList
ReadConsoleW
SetStdHandle
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetCommandLineW
GetCommandLineA
GetModuleFileNameA
HeapReAlloc
HeapFree
HeapAlloc
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
ExitProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
QueryPerformanceFrequency
TryEnterCriticalSection
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
GetLocaleInfoW
GetStringTypeW
ResetEvent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
SetConsoleCtrlHandler
user32
GetUserObjectInformationW
MessageBoxA
GetProcessWindowStation
shell32
SHGetFolderPathA
advapi32
RegisterEventSourceA
DeregisterEventSource
ReportEventA
ws2_32
WSASendTo
WSARecvFrom
WSAIoctl
WSASetLastError
shutdown
setsockopt
select
ntohs
ntohl
listen
htons
getaddrinfo
__WSAFDIsSet
getsockname
ioctlsocket
connect
closesocket
bind
accept
WSASend
WSARecv
WSAGetLastError
WSACleanup
WSAStartup
WSASocketW
freeaddrinfo
WSAStringToAddressW
recv
send
htonl
getsockopt
mswsock
AcceptEx
GetAcceptExSockaddrs
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 501KB - Virtual size: 500KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 82KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ