Static task
static1
Behavioral task
behavioral1
Sample
dc93c73e34b7548a54b64e8096d031fc969b6477e9fe84226ed4c13d11fede7e.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
dc93c73e34b7548a54b64e8096d031fc969b6477e9fe84226ed4c13d11fede7e.exe
Resource
win10v2004-20231023-en
General
-
Target
dc93c73e34b7548a54b64e8096d031fc969b6477e9fe84226ed4c13d11fede7e
-
Size
12KB
-
MD5
e9dd9f5187bf569291b3b95873510c11
-
SHA1
d2ae0c7596ea052c7b531c92a52bf017ca6fa457
-
SHA256
dc93c73e34b7548a54b64e8096d031fc969b6477e9fe84226ed4c13d11fede7e
-
SHA512
56bbba941d0a0644933b5b31781818be58c4f7d4dbdf64beaed8c19fb6dbaf2cf10a042eb5bf5862321f2be73c9817022ccb0c23933a0436a8793771a3abe515
-
SSDEEP
192:jN+3OcwFZA0+YIhebPm94i4zTkiysQ5tfXcon5EbG5:Z+30Fa0+YACmUz8s16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc93c73e34b7548a54b64e8096d031fc969b6477e9fe84226ed4c13d11fede7e
Files
-
dc93c73e34b7548a54b64e8096d031fc969b6477e9fe84226ed4c13d11fede7e.exe windows:6 windows x64 arch:x64
f879ee084f94cc8260401cc24d0bd5e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetCurrentProcess
OpenProcess
Sleep
LoadLibraryA
CloseHandle
GetProcAddress
VirtualAllocEx
GetCurrentProcessId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
vcruntime140
__C_specific_handler
__current_exception
memset
__current_exception_context
memcpy
api-ms-win-crt-runtime-l1-1-0
_c_exit
exit
_cexit
_register_onexit_function
_crt_atexit
terminate
_initterm
__p___argv
__p___argc
_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_set_app_type
_seh_filter_exe
api-ms-win-crt-time-l1-1-0
_time64
_difftime64
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vfprintf
__p__commode
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ