Static task
static1
Behavioral task
behavioral1
Sample
a8f742955533b0638bef30177c9665a81fa9e30f793620999a001ca40356e890.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
a8f742955533b0638bef30177c9665a81fa9e30f793620999a001ca40356e890.exe
Resource
win10v2004-20231025-en
General
-
Target
a8f742955533b0638bef30177c9665a81fa9e30f793620999a001ca40356e890
-
Size
1.5MB
-
MD5
5169dace833a7d2589c3c7e296b29e1e
-
SHA1
9f0167ec57e4c95351cd0e7de14b68e13a98e4cb
-
SHA256
a8f742955533b0638bef30177c9665a81fa9e30f793620999a001ca40356e890
-
SHA512
7d022ee041ee7cfabd5a0bd18d607e8ba8cfe5075532487632d1abac2f12fea0005010aa8bc671e567bdefff28d024a23cbdf7ccc9bfa1117f4a2cfcb41c2be3
-
SSDEEP
12288:/+nVQurIlyo+5aCIHRsMsPSK6yyVf6I5z8JXqJvQV2n:/+nVQuuyo+ixxa6yUz8RqJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8f742955533b0638bef30177c9665a81fa9e30f793620999a001ca40356e890
Files
-
a8f742955533b0638bef30177c9665a81fa9e30f793620999a001ca40356e890.exe windows:5 windows x86 arch:x86
1159beccd5e084fb4202fe550561e7f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
LoadLibraryW
OutputDebugStringA
WideCharToMultiByte
OutputDebugStringW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetProcAddress
GetTickCount
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSetInformation
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyW
RegSetValueExW
msvcp100
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
msvcr100
tolower
wcsrchr
_itow
exit
_unlock
malloc
_lock
_onexit
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_vswprintf
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_CxxThrowException
memcpy
memset
free
_wtoi
_itoa
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
wprintf
__set_app_type
__dllonexit
__CxxFrameHandler3
libcurl
curl_easy_init
curl_slist_free_all
curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_slist_append
curl_easy_getinfo
shlwapi
PathFileExistsW
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE