Static task
static1
Behavioral task
behavioral1
Sample
606c329a0308cfac1209b5bc81a494657a474fff833de5af6e530a54db48f77f.exe
Resource
win7-20231025-en
General
-
Target
606c329a0308cfac1209b5bc81a494657a474fff833de5af6e530a54db48f77f
-
Size
1.5MB
-
MD5
f9e57d688b4613e681a5161553e60523
-
SHA1
0e5ec75e940eb358c0e3bd1b7819e4673e9d39f9
-
SHA256
606c329a0308cfac1209b5bc81a494657a474fff833de5af6e530a54db48f77f
-
SHA512
f60c44bf6915f3ff96bf0cad5f8aa50f724ccb591fba9d3830271e3531764a22b583ef9644142f6e176314b1a0eac8c913a0835fca65d1dedd285e6d6f163341
-
SSDEEP
24576:C3+KY1wXr+qacsqjnhMgeiCl7G0nehbGZpbD:DKEwb+q/Dmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 606c329a0308cfac1209b5bc81a494657a474fff833de5af6e530a54db48f77f
Files
-
606c329a0308cfac1209b5bc81a494657a474fff833de5af6e530a54db48f77f.exe windows:6 windows x86 arch:x86
6f72dcf847a5f386d43cb44c0caeca7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
shlwapi
PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW
StrStrIW
PathFindFileNameW
kernel32
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
DeleteFileW
GetModuleFileNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetFileAttributesW
Sleep
GetCurrentProcess
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileAttributesExW
FindFirstFileW
ReadFile
DeviceIoControl
GetTickCount
WriteFile
SetFilePointer
RemoveDirectoryW
FindNextFileW
FindClose
InitializeCriticalSectionAndSpinCount
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
GetVersion
GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ExpandEnvironmentStringsW
GetLongPathNameW
GetLocalTime
CreateDirectoryW
LoadLibraryW
SetFileAttributesW
FreeLibrary
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
MoveFileExW
CopyFileW
VirtualAlloc
VirtualFree
MoveFileW
OutputDebugStringW
IsDebuggerPresent
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
DecodePointer
WriteConsoleW
GetProcAddress
GetModuleHandleW
GetLastError
RaiseException
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetFileType
GetStringTypeW
EncodePointer
QueryPerformanceCounter
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetACP
advapi32
RegCreateKeyExW
RegDeleteKeyW
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE