Static task
static1
Behavioral task
behavioral1
Sample
ffc43a6efe052aeb21ff7d4b4656bb7a5c9f9ec1d9ffc8fd3cb96e6855806e2b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
ffc43a6efe052aeb21ff7d4b4656bb7a5c9f9ec1d9ffc8fd3cb96e6855806e2b.exe
Resource
win10v2004-20231023-en
General
-
Target
ffc43a6efe052aeb21ff7d4b4656bb7a5c9f9ec1d9ffc8fd3cb96e6855806e2b
-
Size
124KB
-
MD5
38d48783e3eb17f54521f5017ddd1be6
-
SHA1
9328fbd8a22df7c0d92636963c97b337a59957e1
-
SHA256
ffc43a6efe052aeb21ff7d4b4656bb7a5c9f9ec1d9ffc8fd3cb96e6855806e2b
-
SHA512
3bd5f8afdb1bee2ade88cbaf95e38d41616ce9a7c399af7e65e63bbe1fa0276f8db3401719aad8bb5e10c3368a70cef0a3768914364b657459a1f47a7b179873
-
SSDEEP
3072:gY5kyF5tTe6gOYPY95qrB5gpwkG2XGIOVHlU7H3v1/MACubCdlKjs54nntspSnf2:gY5rF5tTe6gOYPY95qrB5gpwkG2XGIOR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffc43a6efe052aeb21ff7d4b4656bb7a5c9f9ec1d9ffc8fd3cb96e6855806e2b
Files
-
ffc43a6efe052aeb21ff7d4b4656bb7a5c9f9ec1d9ffc8fd3cb96e6855806e2b.exe windows:5 windows x86
d387493f99c7a70591c9f021eca7caf7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
dnsapi
DnsFlushResolverCache
DnsGetCacheDataTable
DnsQuery_W
DnsRecordListFree
iphlpapi
GetAdaptersInfo
GetIfEntry
GetInterfaceInfo
GetNetworkParams
GetPerAdapterInfo
IpReleaseAddress
IpRenewAddress
kernel32
DeleteCriticalSection
EnterCriticalSection
FindResourceA
FormatMessageA
GetComputerNameExA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
QueryPerformanceCounter
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
lstrcmpA
lstrlenA
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_fpreset
_initterm
_iob
_lock
_onexit
_stricmp
_strnicmp
_unlock
abort
asctime
calloc
exit
fprintf
free
fwrite
localtime
malloc
memmove
printf
putchar
puts
signal
sprintf
strncmp
vfprintf
user32
CharToOemA
LoadStringA
wsprintfA
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rossym Size: 27KB - Virtual size: 27KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ