Static task
static1
Behavioral task
behavioral1
Sample
6a3470edcb0edd9d642b3f1f5740b1dc2d48759452b1c78769df366ce53de3e8.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6a3470edcb0edd9d642b3f1f5740b1dc2d48759452b1c78769df366ce53de3e8.exe
Resource
win10v2004-20231023-en
General
-
Target
6a3470edcb0edd9d642b3f1f5740b1dc2d48759452b1c78769df366ce53de3e8
-
Size
144KB
-
MD5
d6a95bd19739129469b82f148421fd94
-
SHA1
fca4f0d2b890b82df6062a813a3f9062fccaf57c
-
SHA256
6a3470edcb0edd9d642b3f1f5740b1dc2d48759452b1c78769df366ce53de3e8
-
SHA512
6dfe18d912c23d5ce33bbc36d783e91fa4e9330a5f355deaa5bb928b6039cc76439ec86ab82bc94d2eae07b6316fd5fff6da2f608a8391b3ff297989eb2f664e
-
SSDEEP
3072:bRpXOmhQ3ScPSoxvshTsKEFUzXDJWJc8lxD7Kn:fYCcPSoOrEuGhK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a3470edcb0edd9d642b3f1f5740b1dc2d48759452b1c78769df366ce53de3e8
Files
-
6a3470edcb0edd9d642b3f1f5740b1dc2d48759452b1c78769df366ce53de3e8.exe windows:5 windows x86 arch:x86
e124a6cece7bba9d313f639ed6516504
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcessHeap
MultiByteToWideChar
TerminateProcess
GetModuleFileNameW
GetFileAttributesW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
ExpandEnvironmentStringsA
HeapAlloc
WriteConsoleW
SetFilePointerEx
HeapReAlloc
GetModuleHandleW
FindClose
SetLastError
GetProcAddress
LoadLibraryW
GetLastError
GetCurrentProcess
FlushFileBuffers
WideCharToMultiByte
DeleteCriticalSection
GetLocalTime
CloseHandle
DeleteFileW
EnterCriticalSection
Sleep
CreateFileW
WaitForSingleObject
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
OutputDebugStringA
WriteFile
CreateToolhelp32Snapshot
HeapSize
GetConsoleMode
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
GetFileType
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
DecodePointer
advapi32
StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
DuplicateTokenEx
userenv
CreateEnvironmentBlock
wtsapi32
WTSQueryUserToken
Sections
.text Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ