h
Static task
static1
Behavioral task
behavioral1
Sample
2dfc91e18477ba4bbbbe470075d9fe7205089c78640910040ce0a2208687ece0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
2dfc91e18477ba4bbbbe470075d9fe7205089c78640910040ce0a2208687ece0.exe
Resource
win10v2004-20231023-en
General
-
Target
2dfc91e18477ba4bbbbe470075d9fe7205089c78640910040ce0a2208687ece0
-
Size
11.5MB
-
MD5
407339d524811cb028ae37dc26f4e219
-
SHA1
6e9f34794d215d7b3f26451b8b5f201807bf7845
-
SHA256
2dfc91e18477ba4bbbbe470075d9fe7205089c78640910040ce0a2208687ece0
-
SHA512
d056cb6879a9f010fb400f4cbfa0ce972b696deb470a15d1e76be4b47ee52783b7f9ae234505138ca83f9740dd7fd09ca8d9934f6f69198c1b97ee4a5465774f
-
SSDEEP
1536:P8TmBIho1tWbUTN108XOxeP8Vzim18+MHpShmKFWTWCg1IEOxBIhZZCt:U6Oi0UpDexBNNcowKMTWB1InxOZZCt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dfc91e18477ba4bbbbe470075d9fe7205089c78640910040ce0a2208687ece0
Files
-
2dfc91e18477ba4bbbbe470075d9fe7205089c78640910040ce0a2208687ece0.exe windows:5 windows x86
c95404c35cff1432fe8e340fcc9b653d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLocalTime
LeaveCriticalSection
GetTickCount
HeapAlloc
OpenFileMappingW
lstrlenA
WaitNamedPipeA
OpenWaitableTimerA
CreateMutexA
TlsGetValue
lstrlenA
GetProcAddress
CreateFileMappingA
GetStartupInfoW
WriteFile
AllocConsole
DeleteFileA
GetStringTypeW
LoadLibraryExW
LoadLibraryA
lstrlenA
GetVersionExW
user32
LoadMenuA
InsertMenuA
GetDlgItemTextW
IsDialogMessageA
GetPropW
DispatchMessageW
IsCharLowerW
PeekMessageA
LoadIconA
GetClassLongA
rsaenh
CPDeriveKey
CPCreateHash
CPEncrypt
CPDecrypt
crypt32
CryptFindOIDInfo
CryptMemAlloc
CertAlgIdToOID
CertFreeCRLContext
CertDuplicateCRLContext
CertSaveStore
CertDeleteCRLFromStore
CertControlStore
CertNameToStrA
CertOpenStore
CertFindAttribute
CertFindChainInStore
CertCreateCTLContext
CertCreateContext
CertGetNameStringA
CertDuplicateStore
CertFindExtension
cmpbk32
PhoneBookFreeFilter
PhoneBookCopyFilter
dsprop
FindSheet
CrackName
certcli
CACloseCA
CADeleteCA
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_MEM_READ
.ydata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11.4MB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ