h
Static task
static1
Behavioral task
behavioral1
Sample
13b33a486005cadd434187ba6dfaabc4ffbfa296fa26eb7883db5ed646fdc985.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
13b33a486005cadd434187ba6dfaabc4ffbfa296fa26eb7883db5ed646fdc985.exe
Resource
win10v2004-20231023-en
General
-
Target
13b33a486005cadd434187ba6dfaabc4ffbfa296fa26eb7883db5ed646fdc985
-
Size
11.6MB
-
MD5
f537901667e970bb0f90a23d9f41ca47
-
SHA1
c6ff27c4a677c05b8b499378f766fee2dfc00b0a
-
SHA256
13b33a486005cadd434187ba6dfaabc4ffbfa296fa26eb7883db5ed646fdc985
-
SHA512
c2008c469dca56c4f6a8129537a381d28aadf189238a78fea99117bb6bf10188a55f3de5c0614303d78227fe1b1af38f2ace7b630a5031935b99e7d11b45f1c3
-
SSDEEP
1536:08TmBIho1tWbUTN108XOxeP8Vzim18+MHpShmKFWTWCg1IEOxBIhZZCt:76Oi0UpDexBNNcowKMTWB1InxOZZCt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 13b33a486005cadd434187ba6dfaabc4ffbfa296fa26eb7883db5ed646fdc985
Files
-
13b33a486005cadd434187ba6dfaabc4ffbfa296fa26eb7883db5ed646fdc985.exe windows:5 windows x86
c95404c35cff1432fe8e340fcc9b653d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLocalTime
LeaveCriticalSection
GetTickCount
HeapAlloc
OpenFileMappingW
lstrlenA
WaitNamedPipeA
OpenWaitableTimerA
CreateMutexA
TlsGetValue
lstrlenA
GetProcAddress
CreateFileMappingA
GetStartupInfoW
WriteFile
AllocConsole
DeleteFileA
GetStringTypeW
LoadLibraryExW
LoadLibraryA
lstrlenA
GetVersionExW
user32
LoadMenuA
InsertMenuA
GetDlgItemTextW
IsDialogMessageA
GetPropW
DispatchMessageW
IsCharLowerW
PeekMessageA
LoadIconA
GetClassLongA
rsaenh
CPDeriveKey
CPCreateHash
CPEncrypt
CPDecrypt
crypt32
CryptFindOIDInfo
CryptMemAlloc
CertAlgIdToOID
CertFreeCRLContext
CertDuplicateCRLContext
CertSaveStore
CertDeleteCRLFromStore
CertControlStore
CertNameToStrA
CertOpenStore
CertFindAttribute
CertFindChainInStore
CertCreateCTLContext
CertCreateContext
CertGetNameStringA
CertDuplicateStore
CertFindExtension
cmpbk32
PhoneBookFreeFilter
PhoneBookCopyFilter
dsprop
FindSheet
CrackName
certcli
CACloseCA
CADeleteCA
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_MEM_READ
.ydata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11.5MB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ