Static task
static1
Behavioral task
behavioral1
Sample
0e4f83ed20e0fd75fab768deff5b94f5c6b178aa7288667e4e071cead8fec595.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0e4f83ed20e0fd75fab768deff5b94f5c6b178aa7288667e4e071cead8fec595.exe
Resource
win10v2004-20231023-en
General
-
Target
0e4f83ed20e0fd75fab768deff5b94f5c6b178aa7288667e4e071cead8fec595
-
Size
10.0MB
-
MD5
2cf573eb10cd1c0d6d579db881a22e9b
-
SHA1
499bb34828c57e0dc741617ba779e93ea57058fe
-
SHA256
0e4f83ed20e0fd75fab768deff5b94f5c6b178aa7288667e4e071cead8fec595
-
SHA512
49015eeb335c514f95e10c2205c3b7050ec941c281d11d5542546e32440af47b22f3ef23f9e5a36389699575a91685f66bf01c0a2a0e15ede9f91dfd4d3c12bd
-
SSDEEP
196608:GJyyGOIiRkOY5PnbhS1d8VFD0yx9WX9hb:4jPRkOY5PntSf8VFTmXPb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e4f83ed20e0fd75fab768deff5b94f5c6b178aa7288667e4e071cead8fec595
Files
-
0e4f83ed20e0fd75fab768deff5b94f5c6b178aa7288667e4e071cead8fec595.exe windows:5 windows x86
8fc25984a37a543e921b8a8f6a3a86eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
CreateFileW
ReadFile
WriteFile
MultiByteToWideChar
GetExitCodeProcess
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
SetEvent
CreateMutexW
GetCurrentProcess
GetLocaleInfoW
CreateProcessW
GetSystemTime
GetDiskFreeSpaceExW
GetModuleHandleW
OpenEventW
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCommandLineW
SetLastError
CreateThread
CloseHandle
SetEnvironmentVariableA
CompareStringW
LoadLibraryW
WriteConsoleW
GetTimeZoneInformation
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
CreateEventW
GetCurrentThreadId
WaitForSingleObject
FreeEnvironmentStringsW
FlushFileBuffers
HeapCreate
ExitProcess
SetFilePointer
GetConsoleMode
GetLastError
GetTempPathW
GetModuleFileNameW
DeleteFileW
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
GetConsoleCP
GetStdHandle
SetHandleCount
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
IsValidCodePage
GetOEMCP
GetACP
SizeofResource
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetProcAddress
GetVersionExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetStringTypeW
InitializeCriticalSection
EncodePointer
DecodePointer
RtlUnwind
CreateDirectoryW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
GetCPInfo
HeapSetInformation
GetStartupInfoW
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
user32
GetWindowLongW
ExitWindowsEx
SetWindowTextW
SetWindowPos
GetWindowRect
FindWindowW
SendMessageW
GetDlgItem
MapWindowPoints
MessageBoxW
UnregisterClassA
SetWindowLongW
GetActiveWindow
DialogBoxParamW
EndDialog
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
shell32
ShellExecuteExW
CommandLineToArgvW
ole32
CoInitialize
advapi32
RegQueryValueExW
RegEnumValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
comctl32
ord17
msi
ord159
ord141
ord8
ord116
ord160
ord158
ord32
ord72
ord94
ord92
shlwapi
StrChrW
PathFileExistsW
PathCombineW
PathAppendW
Sections
.text Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 332KB - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ