Static task
static1
Behavioral task
behavioral1
Sample
fbc0fbd11a33533ed1d74368b696319d1b4dff7eb143d5288dfc0b550124597a.exe
Resource
win10v2004-20231127-en
General
-
Target
fbc0fbd11a33533ed1d74368b696319d1b4dff7eb143d5288dfc0b550124597a
-
Size
257KB
-
MD5
d090f42d9775b4b662c9a01bb3259efb
-
SHA1
2375d0edcd07538fe07c7b3f084bd4a35a2c9d85
-
SHA256
fbc0fbd11a33533ed1d74368b696319d1b4dff7eb143d5288dfc0b550124597a
-
SHA512
c0a4ec48901ea68ab82a37aa8e2bf02a2bf93d817e55aa62b0a1ef08ec3ff1ee619c6ff7bc57bc5243fe139baa4ae310e4a3a2cb5fb9dd748d2cf3faccb27284
-
SSDEEP
3072:HpsMVLIatu3RtLGl7eNRkPecbB2ACISlLs+oYl2pWE5CMdLv9sHTu:WMVLLtj7eNseI2G4oYlIRVMT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbc0fbd11a33533ed1d74368b696319d1b4dff7eb143d5288dfc0b550124597a
Files
-
fbc0fbd11a33533ed1d74368b696319d1b4dff7eb143d5288dfc0b550124597a.exe windows:5 windows x86 arch:x86
b82ed92bb104aba6fdd225134520f024
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SystemTimeToTzSpecificLocalTime
InterlockedDecrement
GetCurrentProcess
GetSystemWindowsDirectoryW
InterlockedCompareExchange
GetComputerNameW
OpenSemaphoreA
BackupSeek
GetTickCount
GetConsoleAliasesLengthA
GetDateFormatA
TlsSetValue
GetVolumePathNameW
GetCurrencyFormatW
GlobalAlloc
Sleep
AssignProcessToJobObject
SizeofResource
GetVersionExW
ReadFile
CreateFileW
CreateJobObjectA
LCMapStringA
GetLastError
SetLastError
GetProcAddress
GetProcessHeaps
VirtualAlloc
BeginUpdateResourceW
BackupWrite
EnumDateFormatsExA
SetComputerNameA
LoadLibraryA
CreateFileMappingW
GlobalFindAtomW
FindFirstVolumeMountPointA
CreateIoCompletionPort
GetModuleHandleA
VirtualProtect
FindAtomW
EnumResourceLanguagesW
GlobalAddAtomW
GetFullPathNameA
FindFirstChangeNotificationW
InterlockedExchange
GetComputerNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
GetStartupInfoW
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsFree
GetCurrentThreadId
HeapSize
HeapFree
TerminateProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapAlloc
HeapReAlloc
RtlUnwind
user32
RealGetWindowClassA
gdi32
SetDeviceGammaRamp
advapi32
RegisterEventSourceW
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ