Static task
static1
Behavioral task
behavioral1
Sample
8a8d6785e83b9e80734cac5b00cfcac349d401a6c6685e3e0d7557732d7602ba.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
8a8d6785e83b9e80734cac5b00cfcac349d401a6c6685e3e0d7557732d7602ba.exe
Resource
win10v2004-20231020-en
General
-
Target
8a8d6785e83b9e80734cac5b00cfcac349d401a6c6685e3e0d7557732d7602ba
-
Size
8.6MB
-
MD5
79d54c858d08c12321c57cad9a4a238c
-
SHA1
d08a192a1d30fc959eea6e80dc58bb03e06c982a
-
SHA256
8a8d6785e83b9e80734cac5b00cfcac349d401a6c6685e3e0d7557732d7602ba
-
SHA512
6b9eb52b55c0d6793626ce26fc4aa15916f3714cf4f87a946c7031ccab3cee3ac06766d05fbb170fe9b214bb6daf277ced2116942ef119d346f8379f7e14a5d7
-
SSDEEP
196608:PLzVFOad1ISjzapRzmfTu3Js5AjU0FtgK:PLzV4al6XzwCZs5AjUGgK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a8d6785e83b9e80734cac5b00cfcac349d401a6c6685e3e0d7557732d7602ba
Files
-
8a8d6785e83b9e80734cac5b00cfcac349d401a6c6685e3e0d7557732d7602ba.exe windows:5 windows x86 arch:x86
898b9023f9c8481b10ad4770e9c35f5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
TryEnterCriticalSection
HeapReAlloc
GetSystemInfo
SetCurrentDirectoryW
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetCurrentProcessId
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetModuleHandleA
GetVersion
GetFileType
GlobalMemoryStatus
FlushConsoleInputBuffer
LoadLibraryW
FindResourceW
LoadResource
FreeResource
SizeofResource
AreFileApisANSI
GetStdHandle
FreeLibrary
GetVersionExA
SetLastError
GetComputerNameA
OutputDebugStringW
CreateProcessA
GetStartupInfoA
CreateFileA
CreatePipe
GetCommandLineW
WideCharToMultiByte
GetFileSize
SetFileAttributesW
GetFileAttributesW
VirtualAlloc
WriteFile
lstrlenW
VirtualFree
ReadFile
GetSystemTime
SystemTimeToFileTime
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
CreateDirectoryW
DeleteFileA
FindClose
FindNextFileW
FindFirstFileW
GetDiskFreeSpaceExW
MultiByteToWideChar
GetProcessHeap
GetComputerNameW
LocalFree
HeapAlloc
CloseHandle
GetSystemDirectoryA
GetLastError
CreateFileW
GetVolumeInformationA
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
ReadConsoleW
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
DeviceIoControl
HeapFree
GetTickCount
CopyFileW
MoveFileExW
DeleteFileW
LockResource
HeapCompact
IsValidLocale
GetConsoleCP
GetACP
SetConsoleMode
ReadConsoleInputA
EncodePointer
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetCurrentDirectoryW
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
RtlUnwind
LoadLibraryExW
FindFirstFileExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetConsoleMode
user32
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
wsprintfW
advapi32
GetSidSubAuthorityCount
LookupAccountNameW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyW
GetSidSubAuthority
GetUserNameW
GetSidIdentifierAuthority
CryptDestroyKey
CryptAcquireContextA
CryptEncrypt
CryptDeriveKey
RegCreateKeyExW
ConvertSidToStringSidA
LookupAccountNameA
RegEnumKeyExW
CryptAcquireContextW
CopySid
CryptCreateHash
CryptHashData
IsValidSid
RegSetValueExW
CryptDestroyHash
GetLengthSid
CryptGetHashParam
CryptReleaseContext
OpenProcessToken
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegOpenKeyExW
ConvertSidToStringSidW
shell32
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ole32
CoInitialize
oleaut32
SysAllocString
SysFreeString
shlwapi
PathIsRelativeW
PathCombineW
PathFileExistsW
netapi32
Netbios
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 261KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 568B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ