Static task
static1
Behavioral task
behavioral1
Sample
2d03c5ef3cfec6d89bf3abacf6fa138e0deda4382cd27b6483614f74457bae4c.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2d03c5ef3cfec6d89bf3abacf6fa138e0deda4382cd27b6483614f74457bae4c.exe
Resource
win10v2004-20231023-en
General
-
Target
2d03c5ef3cfec6d89bf3abacf6fa138e0deda4382cd27b6483614f74457bae4c
-
Size
888KB
-
MD5
6513ca594f118d8ce42fbca4be67a0d8
-
SHA1
d7d6021bf894762b4af13e1879ab749893425d0a
-
SHA256
2d03c5ef3cfec6d89bf3abacf6fa138e0deda4382cd27b6483614f74457bae4c
-
SHA512
8b90b1411e05e6557548e64467ac36c99e2417ba0b35335a9d50175bf9a9905cd8093dde555613e45f331f3b1070f8fa50361a50df43d4229e99c2998046ac03
-
SSDEEP
24576:IqcisVnEupEnPTSC2Ub1kf9G84kRp1ueKwPbX:haEnPTkf9G84kRue1X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d03c5ef3cfec6d89bf3abacf6fa138e0deda4382cd27b6483614f74457bae4c
Files
-
2d03c5ef3cfec6d89bf3abacf6fa138e0deda4382cd27b6483614f74457bae4c.exe windows:6 windows x86 arch:x86
101a9a8eaf371b428893ae9d1ac6a3aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrcmpiW
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeResource
FormatMessageW
IsDebuggerPresent
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FreeLibrary
FindResourceExW
GetCurrentThreadId
CreateThread
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringW
ReadFile
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
GetCommandLineW
CreateFileW
LocalFree
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetCurrentThread
GetModuleHandleExW
ExitProcess
WriteFile
GetStdHandle
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
GetFileAttributesExW
InterlockedFlushSList
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
WriteConsoleW
user32
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
CharNextW
MessageBoxW
UnregisterClassW
advapi32
SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptEncrypt
CryptDestroyKey
CryptDeriveKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
ole32
CoInitializeEx
CoRegisterClassObject
CoTaskMemRealloc
CoRevokeClassObject
CoResumeClassObjects
CoTaskMemFree
CoReleaseServerProcess
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoUninitialize
CoAddRefServerProcess
oleaut32
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString
SysAllocString
VarUI4FromStr
UnRegisterTypeLi
Sections
.text Size: 712KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ