Static task
static1
Behavioral task
behavioral1
Sample
0a4c4d36136f0a1f9d3a010953e44778657965ee155b47e784e342979bae8896.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0a4c4d36136f0a1f9d3a010953e44778657965ee155b47e784e342979bae8896.exe
Resource
win10v2004-20231020-en
General
-
Target
0a4c4d36136f0a1f9d3a010953e44778657965ee155b47e784e342979bae8896
-
Size
144KB
-
MD5
ef99981fae6eec891debf3a9e2b17cc1
-
SHA1
30222242cf0cf08a8350619a669b93e4aa3816b8
-
SHA256
0a4c4d36136f0a1f9d3a010953e44778657965ee155b47e784e342979bae8896
-
SHA512
b4142cbd9f9c67195a3c136b2c67608f4ac3866aecd9be1de7e49cec051b1d72f1a316946a93bd21669dacfd8bf3097737abb181c8be023242e51a4ada719ba1
-
SSDEEP
3072:dRpXOmhQ3ScPSoxvshTsKEFUzXDJWJc8ltD7KY:pYCcPSoOrEuGdK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a4c4d36136f0a1f9d3a010953e44778657965ee155b47e784e342979bae8896
Files
-
0a4c4d36136f0a1f9d3a010953e44778657965ee155b47e784e342979bae8896.exe windows:5 windows x86 arch:x86
e124a6cece7bba9d313f639ed6516504
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcessHeap
MultiByteToWideChar
TerminateProcess
GetModuleFileNameW
GetFileAttributesW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
ExpandEnvironmentStringsA
HeapAlloc
WriteConsoleW
SetFilePointerEx
HeapReAlloc
GetModuleHandleW
FindClose
SetLastError
GetProcAddress
LoadLibraryW
GetLastError
GetCurrentProcess
FlushFileBuffers
WideCharToMultiByte
DeleteCriticalSection
GetLocalTime
CloseHandle
DeleteFileW
EnterCriticalSection
Sleep
CreateFileW
WaitForSingleObject
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
OutputDebugStringA
WriteFile
CreateToolhelp32Snapshot
HeapSize
GetConsoleMode
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
GetFileType
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
DecodePointer
advapi32
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
DuplicateTokenEx
userenv
CreateEnvironmentBlock
wtsapi32
WTSQueryUserToken
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ