Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231020-en
General
-
Target
tmp
-
Size
986KB
-
MD5
13a33fbaeb4e914a1db2bc7e1b60a2c8
-
SHA1
09da3c9b5a51b29ecbd2cb372dc7d3e66a193dc8
-
SHA256
b5b9e078ab365cc333289e1fa48465414cc06380856b1fd52575cb86711e2eaa
-
SHA512
5fb1dcdba93c1eff699d85172011a4128838f3a4332c92509e8dac9cc9a8ee9ffee08735e78969d008f05e02e189f28d2321c14029cc86a142764088ef5cada5
-
SSDEEP
24576:BxNr66F01fLduhH2FIW8xyA1UqrR2MHyXY:HNr66kS2FIW8xy7ogMHyI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows:6 windows x86 arch:x86
19785abc3261234db802186c75942a82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
psapi
GetModuleFileNameExA
user32
GetDC
gdi32
LPtoDP
msimg32
AlphaBlend
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
DragFinish
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCA
uxtheme
IsAppThemed
dwmapi
DwmDefWindowProc
ole32
DoDragDrop
oleaut32
SysAllocString
oledlg
ord8
gdiplus
GdipFree
ws2_32
__WSAFDIsSet
oleacc
LresultFromObject
imm32
ImmGetContext
winmm
PlaySoundA
wintrust
WinVerifyTrust
crypt32
CryptMsgClose
wininet
FtpOpenFileA
Sections
ZONEMANX Size: 711KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ZONEMANX Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE