Static task
static1
Behavioral task
behavioral1
Sample
6951c8832c6928f1433bfbf2162c504f3b1e188132daf242f1282f0558ede8ef.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6951c8832c6928f1433bfbf2162c504f3b1e188132daf242f1282f0558ede8ef.exe
Resource
win10v2004-20231023-en
General
-
Target
6951c8832c6928f1433bfbf2162c504f3b1e188132daf242f1282f0558ede8ef
-
Size
450KB
-
MD5
96089040d8e59ede26ba155fdb0830f8
-
SHA1
b4f13ee7c50871d8eb4ab8faf142e5c1cf97aac2
-
SHA256
6951c8832c6928f1433bfbf2162c504f3b1e188132daf242f1282f0558ede8ef
-
SHA512
c9ddc600f9ec914fb8d87b724644cf98f39d26202f92fd76168341507feddbce4495a4ffc8548986267fa573bbf50d5639317fd9ca4956cb980cfaf996f212c6
-
SSDEEP
12288:JAmyXM1FLh+moqhjdzADZMdTy+mevAKuBsEYYYNxJz:JAmyXC/jdzyZStf9uEHz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6951c8832c6928f1433bfbf2162c504f3b1e188132daf242f1282f0558ede8ef
Files
-
6951c8832c6928f1433bfbf2162c504f3b1e188132daf242f1282f0558ede8ef.exe windows:4 windows x64 arch:x64
259785ff1f808ea6e78c6a528359f1e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
iphlpapi
GetAdaptersInfo
kernel32
CloseHandle
CreateMutexA
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetACP
GetCommandLineW
GetComputerNameW
GetCurrentThreadId
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetVersionExW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
SetEnvironmentVariableA
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__initenv
__iob_func
__getmainargs
__set_app_type
_acmdln
__setusermatherr
_amsg_exit
_beginthread
_cexit
_commode
_findclose
_fmode
_endthread
_errno
_ftime64
memcmp
memcpy
memmove
memset
rewind
_get_osfhandle
_gmtime64
_initterm
_lock
_onexit
_open
_open_osfhandle
_pipe
_stat64
_strnicmp
_time64
_unlock
_wchdir
_wfindfirst64
_wfindnext64
_wgetcwd
_wmkdir
_wopen
_wremove
_wrmdir
_wstat64
abort
bsearch
calloc
exit
fclose
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
getc
getenv
islower
isspace
isupper
isxdigit
localeconv
malloc
qsort
rand
realloc
remove
signal
sprintf
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strstr
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcslen
_write
_unlink
_read
_open
_getpid
_close
_chmod
shell32
CommandLineToArgvW
user32
DispatchMessageW
GetSystemMetrics
PeekMessageW
TranslateMessage
ws2_32
WSAAddressToStringA
WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
WSAStringToAddressA
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
shutdown
socket
Sections
.text Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ