Static task
static1
Behavioral task
behavioral1
Sample
4b133f1863422ad32c672ff15208171cfc589978731c0e412984d9a39ab036a9.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4b133f1863422ad32c672ff15208171cfc589978731c0e412984d9a39ab036a9.exe
Resource
win10v2004-20231023-en
General
-
Target
4b133f1863422ad32c672ff15208171cfc589978731c0e412984d9a39ab036a9
-
Size
487KB
-
MD5
3a4ca157d190bd94a73d46d5df1406b4
-
SHA1
40e760bc07eebfeb4ce5cccc610a2a7e1f69abd2
-
SHA256
4b133f1863422ad32c672ff15208171cfc589978731c0e412984d9a39ab036a9
-
SHA512
a78d55dead241d40533c23daf0c68c1ce3606d5dea1cf6b1544f46a107c471d4ac6119ab9af8d8b2b6e04173477a8d762260b0d5ac4790c16ae2a7b9144874fe
-
SSDEEP
12288:A5KZO2WXfWL/Yr+Q+RWDQZIWJSbc4ZRj2K:MKZf/++QaWbc4ZRj2K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b133f1863422ad32c672ff15208171cfc589978731c0e412984d9a39ab036a9
Files
-
4b133f1863422ad32c672ff15208171cfc589978731c0e412984d9a39ab036a9.exe windows:5 windows x86 arch:x86
722ad61581e2377b55bf1fcb067a6c11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
GetDriveTypeW
GetDiskFreeSpaceExW
CreateDirectoryW
SetFileAttributesW
GetFileAttributesW
GetVolumeInformationW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetModuleFileNameW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
SetErrorMode
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetProcAddress
ExpandEnvironmentStringsW
SetConsoleCtrlHandler
GetCurrentThread
SetThreadPriority
SetThreadExecutionState
CreateEventW
LoadLibraryW
GetSystemDirectoryW
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
SetStdHandle
GetConsoleCP
HeapAlloc
HeapFree
DecodePointer
HeapSize
SetFilePointerEx
FormatMessageW
Sleep
SetLastError
GetLastError
LocalFree
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleMode
WriteFile
GetStdHandle
GetFileType
GetCommandLineW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
LCMapStringW
FindNextFileA
FindFirstFileExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameA
GetCommandLineA
GetACP
GetStringTypeW
HeapReAlloc
user32
OemToCharA
CharToOemA
OemToCharBuffA
ExitWindowsEx
CharLowerW
CharUpperW
MessageBeep
LoadStringW
CharToOemBuffW
advapi32
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
SetFileSecurityW
AdjustTokenPrivileges
OpenProcessToken
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
ole32
CoCreateInstance
CoSetProxyBlanket
oleaut32
SysFreeString
SysAllocString
VariantClear
powrprof
SetSuspendState
Sections
.text Size: 368KB - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ