Static task
static1
Behavioral task
behavioral1
Sample
b76191fc7603445e1c5d4e055f1ec385dfda53ef83d189f5ce3f9f257c67cd0f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b76191fc7603445e1c5d4e055f1ec385dfda53ef83d189f5ce3f9f257c67cd0f.exe
Resource
win10v2004-20231020-en
General
-
Target
b76191fc7603445e1c5d4e055f1ec385dfda53ef83d189f5ce3f9f257c67cd0f
-
Size
293KB
-
MD5
d6452a5e0c8faefa8ce47ae775fe5a41
-
SHA1
65b57523d10a5f9db833b735b6e8615daf2f0fa9
-
SHA256
b76191fc7603445e1c5d4e055f1ec385dfda53ef83d189f5ce3f9f257c67cd0f
-
SHA512
d003efc0dda5842d323a445f84e20dc7ebc959b36a05499da5d0f29964b6564256451a609ba47ecd51daac6c65863a78895bb5abe2d02bf648c8304fcda7f775
-
SSDEEP
3072:qL5y+EudoPve58E1g9Np5nEHqhplGxbcc3jDtnUVF+riVLNfgcvydI3CBVdtsvVb:f+6PwuZIqhpIR3vtnU4mpyu3EtOCts
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b76191fc7603445e1c5d4e055f1ec385dfda53ef83d189f5ce3f9f257c67cd0f
Files
-
b76191fc7603445e1c5d4e055f1ec385dfda53ef83d189f5ce3f9f257c67cd0f.exe windows:6 windows x86
3602a064c80e6b18e82f0f08954034b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
FindFirstFileW
GetModuleHandleExW
GetModuleFileNameW
GetTempPathW
FindClose
CreateFileW
CloseHandle
GetModuleHandleW
GetCurrentProcess
GetCurrentThreadId
ExitProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
CompareFileTime
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
MultiByteToWideChar
OutputDebugStringW
InitializeCriticalSection
GetLocalTime
WideCharToMultiByte
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
Sleep
SetEvent
CreateThread
ResetEvent
FileTimeToSystemTime
SystemTimeToFileTime
GetCommandLineW
CreateMutexW
OpenProcess
MoveFileExW
CreateProcessW
WriteConsoleW
HeapSize
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
DeleteFileW
EnterCriticalSection
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetTimeZoneInformation
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetCPInfo
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileAttributesExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetStdHandle
WriteFile
HeapFree
HeapAlloc
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
user32
PostMessageW
DefWindowProcW
GetMessageW
SendMessageW
RegisterClassExW
IsWindow
DispatchMessageW
TranslateMessage
FindWindowW
PostQuitMessage
MessageBoxW
CreateWindowExW
shell32
CommandLineToArgvW
shlwapi
PathAddBackslashW
Sections
.text Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ