Static task
static1
Behavioral task
behavioral1
Sample
92e2500b24f380e29a28468989270bf02a821c903175c007919eb363df1bb97e.exe
Resource
win10v2004-20231127-en
General
-
Target
92e2500b24f380e29a28468989270bf02a821c903175c007919eb363df1bb97e
-
Size
985KB
-
MD5
3c28dfc1cef8c5f20ccef15d8df97e61
-
SHA1
1ab54a71c1ba59bfc29a08f85ca5ab3d3cd33848
-
SHA256
92e2500b24f380e29a28468989270bf02a821c903175c007919eb363df1bb97e
-
SHA512
3b85bfac9663eb16ee4c29208103ab99d35b6e0e964ef588401ab33bc1c02479a16d298cb01ef0a29a59133f55e7233ac9f5ac9ea7bc76c68eba0eac016cffa8
-
SSDEEP
24576:y+caHlG14UNXi9CQg04KEl9DgD7eiQ/zGF:y+cGA1ygQgTKE3cDiio
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92e2500b24f380e29a28468989270bf02a821c903175c007919eb363df1bb97e
Files
-
92e2500b24f380e29a28468989270bf02a821c903175c007919eb363df1bb97e.exe windows:5 windows x86 arch:x86
d0b4f2d266b4dd8f0ca6862805492b95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
GetSystemWindowsDirectoryW
InterlockedCompareExchange
OpenSemaphoreA
BackupSeek
GetTickCount
GetDateFormatA
TlsSetValue
GetVolumePathNameW
GetCurrencyFormatW
GlobalAlloc
Sleep
AssignProcessToJobObject
SizeofResource
GetVersionExW
ReadFile
CreateFileW
CreateJobObjectA
LCMapStringA
InterlockedExchange
GetConsoleAliasesLengthW
SetLastError
GetProcAddress
GetProcessHeaps
VirtualAlloc
BeginUpdateResourceW
BackupWrite
EnumDateFormatsExA
SetComputerNameA
LoadLibraryA
CreateFileMappingW
GlobalFindAtomW
FindFirstVolumeMountPointA
CreateIoCompletionPort
GetModuleHandleA
VirtualProtect
FindAtomW
EnumResourceLanguagesW
GlobalAddAtomW
GetFullPathNameA
FindFirstChangeNotificationW
GetLastError
GetComputerNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
GetStartupInfoW
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsFree
GetCurrentThreadId
HeapSize
HeapFree
TerminateProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapAlloc
HeapReAlloc
RtlUnwind
user32
RealGetWindowClassA
gdi32
SetDeviceGammaRamp
advapi32
RegisterEventSourceW
Sections
.text Size: 852KB - Virtual size: 852KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ