Static task
static1
Behavioral task
behavioral1
Sample
162a1eb9726c16350bd86935bb5bc8a76cad30529c626eaed28dabdcecf40b1c.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
162a1eb9726c16350bd86935bb5bc8a76cad30529c626eaed28dabdcecf40b1c.exe
Resource
win10v2004-20231023-en
General
-
Target
162a1eb9726c16350bd86935bb5bc8a76cad30529c626eaed28dabdcecf40b1c
-
Size
13.4MB
-
MD5
48c8be2cddc91e04a52597725f84ee63
-
SHA1
235b635de1186b7ad3af9ee5ac6e52cc68e8abf8
-
SHA256
162a1eb9726c16350bd86935bb5bc8a76cad30529c626eaed28dabdcecf40b1c
-
SHA512
bcf5c0be47496d363c3eb96fdc65f011dbc2aebe1823093ca07b8028e0d14002aa2861bd267038fae4ad9332e0acab1b2202d0ef8e401014d38668f720b762a5
-
SSDEEP
393216:BBkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4:rkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 162a1eb9726c16350bd86935bb5bc8a76cad30529c626eaed28dabdcecf40b1c
Files
-
162a1eb9726c16350bd86935bb5bc8a76cad30529c626eaed28dabdcecf40b1c.exe windows:5 windows x86
59fb087240ad80f95696584541ab75cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileW
UpdateResourceW
GetProcAddress
lstrcpy
lstrcpyA
GetFileSize
AllocConsole
LoadLibraryW
CreateFileA
GetModuleHandleA
CopyFileExA
LoadLibraryExW
OpenMutexW
CreateMutexW
GetACP
authz
AuthzInitializeContextFromSid
AuthzFreeContext
AuthzAddSidsToContext
AuthzFreeResourceManager
AuthzFreeAuditEvent
shell32
SHFileOperationA
SHFree
SHGetDesktopFolder
ShellAboutW
SHGetFolderPathA
DragQueryFileA
DllRegisterServer
StrStrA
SHGetDataFromIDListW
ShellMessageBoxW
ShellExecuteW
cfgmgr32
CM_Add_Empty_Log_Conf
CM_Add_Range
CMP_Report_LogOn
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
jdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
jdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.4MB - Virtual size: 87KB
IMAGE_SCN_MEM_READ