Static task
static1
Behavioral task
behavioral1
Sample
cccb8c1843d655f742e2455864697fbe6483588391ee2157750073573486ef10.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
cccb8c1843d655f742e2455864697fbe6483588391ee2157750073573486ef10.exe
Resource
win10v2004-20231023-en
General
-
Target
cccb8c1843d655f742e2455864697fbe6483588391ee2157750073573486ef10
-
Size
1.6MB
-
MD5
d45eeeb9f703e6f5715a7bae53131a62
-
SHA1
c1c4299f75520d3e543108167eb1ca9ced76e7b1
-
SHA256
cccb8c1843d655f742e2455864697fbe6483588391ee2157750073573486ef10
-
SHA512
099144bd24b20ee3fb33e69b1d4d04d2a04e52ba0397ee72045ff45d39c8aeca6234ba70f11f731dc90ccac3b55e4b16b7001625764ce3c0e8a8dd6844f01cd7
-
SSDEEP
24576:b/B2Z5oRiu3a2KWag6wPWrDrODlYzpMYQttobJIoaF+h/:bB2Z5oRiu3a5g6wuryT3ttobJIoac
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cccb8c1843d655f742e2455864697fbe6483588391ee2157750073573486ef10
Files
-
cccb8c1843d655f742e2455864697fbe6483588391ee2157750073573486ef10.exe windows:6 windows x64 arch:x64
69d9ca7b0dccf6a5ccbb3792bc185e55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtReadFile
NtWriteFile
NtCancelIoFileEx
NtDeviceIoControlFile
kernel32
WideCharToMultiByte
CreateThread
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
WaitForSingleObjectEx
WriteConsoleW
GetCurrentProcess
ReleaseMutex
GetCurrentProcessId
CreateMutexA
IsProcessorFeaturePresent
ReleaseSRWLockShared
SetConsoleMode
PostQueuedCompletionStatus
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetModuleHandleW
ReadConsoleW
MultiByteToWideChar
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetEnvironmentVariableW
GetProcAddress
GetModuleHandleA
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
GetFileType
TryAcquireSRWLockExclusive
GetFileInformationByHandleEx
GetConsoleMode
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
Sleep
GetLastError
GetModuleFileNameW
SetLastError
GetCommandLineW
GetStdHandle
HeapReAlloc
FormatMessageW
GetSystemInfo
GetCurrentThread
HeapFree
HeapAlloc
GetProcessHeap
SwitchToThread
ReleaseSRWLockExclusive
QueryPerformanceFrequency
AcquireSRWLockExclusive
CloseHandle
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LoadLibraryA
AcquireSRWLockShared
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
vcruntime140
__CxxFrameHandler3
__C_specific_handler
memmove
memset
__current_exception
memcpy
memcmp
__current_exception_context
api-ms-win-crt-math-l1-1-0
__setusermatherr
pow
api-ms-win-crt-runtime-l1-1-0
exit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_exit
_set_app_type
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ