Static task
static1
Behavioral task
behavioral1
Sample
05908f3e20a1bc17b8c099910d140ec33ee922b168cdc1d37d854717780c7b47.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
05908f3e20a1bc17b8c099910d140ec33ee922b168cdc1d37d854717780c7b47.exe
Resource
win10v2004-20231025-en
General
-
Target
05908f3e20a1bc17b8c099910d140ec33ee922b168cdc1d37d854717780c7b47
-
Size
8.6MB
-
MD5
e13aa466f31a6a490ef671efbac51154
-
SHA1
8f3c48946ef76e3fe6f07339b56aacdfa231554a
-
SHA256
05908f3e20a1bc17b8c099910d140ec33ee922b168cdc1d37d854717780c7b47
-
SHA512
f2591e17439810a12682b36dc417de270f5ee839ab29d6c81962b3371a39b304cf9fd095bfa67e65054196e46eb3b91c04a1b322b4e81237614eabfb4447ea83
-
SSDEEP
196608:7DlsEz1EiRPla5YUHEKYoAwcCwx5GfYgFX+qBlJvkPOsc:7DbnPlq5HaoAwcJx4f/FX+8cO7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05908f3e20a1bc17b8c099910d140ec33ee922b168cdc1d37d854717780c7b47
Files
-
05908f3e20a1bc17b8c099910d140ec33ee922b168cdc1d37d854717780c7b47.exe windows:6 windows x64
ecaf15845b6fa71c2eb49a009c82f784
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
GetComputerNameW
CloseHandle
GetCurrentProcess
GetCommandLineW
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineA
SetCurrentDirectoryW
GetModuleFileNameW
GetModuleHandleW
ReleaseMutex
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryExW
SetDllDirectoryW
GetThreadId
CreateFileW
SetFilePointer
WriteFile
Sleep
CopyFileW
VerSetConditionMask
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDrives
GetVersionExW
GetPhysicallyInstalledSystemMemory
GetModuleHandleA
LoadLibraryW
VerifyVersionInfoW
GetVolumePathNameA
WideCharToMultiByte
GetUserDefaultUILanguage
ReadFile
SetFilePointerEx
GetOverlappedResult
SetEnvironmentVariableW
TerminateProcess
WaitForMultipleObjects
GetCurrentProcessId
GetExitCodeProcess
GetVolumeInformationW
WaitForSingleObject
GetProcessId
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
CreateProcessW
SetThreadUILanguage
GetThreadUILanguage
GetUserDefaultLocaleName
SetLastError
GetCurrentDirectoryW
CreateDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
FormatMessageA
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MultiByteToWideChar
GetTempPathW
GetStartupInfoW
GetTickCount64
WriteConsoleW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetEnvironmentVariableA
GetEnvironmentVariableW
SetEnvironmentVariableA
CompareFileTime
DeleteFileW
FileTimeToLocalFileTime
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
LocalFileTimeToFileTime
AddVectoredExceptionHandler
HeapAlloc
HeapFree
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseSemaphore
CreateEventA
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
SetThreadPriorityBoost
ResumeThread
CreateProcessA
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetLocalTime
VirtualAlloc
VirtualFree
GetProcessAffinityMask
CreateSemaphoreA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemDefaultLocaleName
Process32First
Process32Next
LocalAlloc
WerSetFlags
GetDiskFreeSpaceExW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
ResetEvent
ExitProcess
MoveFileExW
MoveFileWithProgressW
GlobalAddAtomA
GetSystemDefaultUILanguage
CreateFileA
DeleteFileA
ConnectNamedPipe
DisconnectNamedPipe
CancelIoEx
CreateNamedPipeA
GetVolumeInformationA
SetHandleInformation
CreatePipe
SetNamedPipeHandleState
GetWindowsDirectoryA
GetSystemFirmwareTable
FormatMessageW
EncodePointer
DecodePointer
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
WaitForSingleObjectEx
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSection
GetSystemDirectoryW
GetFullPathNameW
OutputDebugStringW
GetStdHandle
GetVersion
SleepEx
GetFileType
UnlockFileEx
LockFileEx
CreateNamedPipeW
TransactNamedPipe
WaitNamedPipeW
FindFirstFileExW
RtlPcToFileHeader
RtlUnwindEx
HeapSize
GetModuleHandleExW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
RtlUnwind
K32EnumProcesses
K32GetProcessImageFileNameA
LoadLibraryA
RemoveVectoredExceptionHandler
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CPADinfo Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 622KB - Virtual size: 622KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 30.8MB - Virtual size: 30.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ