Static task
static1
Behavioral task
behavioral1
Sample
b27323c59498426807574a20824ac525.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
b27323c59498426807574a20824ac525.exe
Resource
win10v2004-20231020-en
General
-
Target
b27323c59498426807574a20824ac525.exe
-
Size
324KB
-
MD5
b27323c59498426807574a20824ac525
-
SHA1
bdee034558b4b105472e0b0c943460746910ace1
-
SHA256
df5397b08e1b72fbf42290033aa11934e895488c93b76e608542fbb49d2e0f98
-
SHA512
c438cf185107f8d69139750415397cb674e0dede0ca72352a738425996d7ca6fa1ded38f1711d29fe4cd7a3056b69397f6b5397f842c29ed50aee3897f5f77f1
-
SSDEEP
6144:tE4bq2jLXveqB+HcDYjOHBhpbiQ4UdnZYrOCa0PEIfuQrk:tEwq2PXvy0YOjpbiQ3nZSPEIfe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b27323c59498426807574a20824ac525.exe
Files
-
b27323c59498426807574a20824ac525.exe.exe windows:6 windows x86
dbe7ea52e4aa8fe765398b6553e86868
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_pton
getaddrinfo
WSAStartup
htonl
inet_ntop
htons
freeaddrinfo
accept
connect
recvfrom
recv
sendto
getpeername
getsockname
getsockopt
ioctlsocket
WSAGetLastError
bind
closesocket
listen
send
socket
ntohl
WSAIoctl
ntohs
dbghelp
SymInitialize
SymFunctionTableAccess64
SymGetModuleBase64
MiniDumpWriteDump
StackWalk64
SymFromAddr
kernel32
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileSizeEx
DeleteFileW
SetFilePointerEx
SetStdHandle
HeapReAlloc
FlushFileBuffers
LCMapStringW
CompareStringW
HeapFree
WriteConsoleW
HeapSize
GetFileAttributesExW
SetEndOfFile
CreateProcessW
GetExitCodeProcess
Sleep
GetModuleFileNameA
GetCurrentProcess
LockFile
GetCurrentThreadId
FreeEnvironmentStringsW
GetCurrentThread
CloseHandle
GetCurrentProcessId
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
FindClose
FindNextFileW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
InitializeSRWLock
InitOnceExecuteOnce
SetLastError
GetHandleInformation
GetTickCount64
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
GetQueuedCompletionStatusEx
GetProcAddress
AcquireSRWLockShared
GetModuleHandleW
CreateIoCompletionPort
SetFileCompletionNotificationModes
HeapAlloc
DecodePointer
GetStringTypeW
GetProcessHeap
CreateFileA
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetTimeZoneInformation
ReadFile
CreateFileW
GetFileType
GetStdHandle
WriteFile
GetModuleFileNameW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
DuplicateHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
WaitForSingleObject
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 262KB - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ