Static task
static1
Behavioral task
behavioral1
Sample
05c43470e7ba8da0b102e2164500b98f1a0995034f81ceece3a1cce878ca3b7f.exe
Resource
win7-20231201-en
General
-
Target
05c43470e7ba8da0b102e2164500b98f1a0995034f81ceece3a1cce878ca3b7f
-
Size
1.2MB
-
MD5
1afa8a16eadd939e8ba2b5a980fb22f1
-
SHA1
2650d83a0e71c3be69844f8db15f512ee69a2166
-
SHA256
05c43470e7ba8da0b102e2164500b98f1a0995034f81ceece3a1cce878ca3b7f
-
SHA512
f8f0355c0d53f3bedf2fa2df2e9650b882ce71bcc6c04b1d059f01a7443a170727b552aeacccf2f77b3cf894a13ca76f167d338fcb204d27e7c7d171b1236448
-
SSDEEP
24576:10qmJe3wccSqqYj4Z7BYCLVyjzWDwCmTPPk/z5Zf5hz0dNUX:10eZqjEnYCLVBDwCmTPc/lZfuN4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05c43470e7ba8da0b102e2164500b98f1a0995034f81ceece3a1cce878ca3b7f
Files
-
05c43470e7ba8da0b102e2164500b98f1a0995034f81ceece3a1cce878ca3b7f.exe windows:6 windows x86 arch:x86
dd2655d36468bc13ed014e028c963a93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventW
CloseHandle
RaiseException
DecodePointer
SetLastError
DebugBreak
Sleep
IsDebuggerPresent
EnterCriticalSection
GetCurrentProcess
LeaveCriticalSection
GetVersionExW
LocalFree
FormatMessageW
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
WideCharToMultiByte
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SetErrorMode
SizeofResource
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
FileTimeToSystemTime
MultiByteToWideChar
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindNextFileW
GetFileAttributesW
GetTempPathW
GetCurrentThread
GetTickCount
GetSystemDirectoryW
lstrcmpW
DuplicateHandle
TerminateProcess
ExpandEnvironmentStringsW
LocalAlloc
VerSetConditionMask
CompareFileTime
GetFullPathNameW
OutputDebugStringW
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
lstrcmpA
VerifyVersionInfoW
GetSystemInfo
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitProcess
GetStdHandle
WriteFile
GetACP
GetFileType
LCMapStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
user32
MessageBoxW
advapi32
OpenProcessToken
GetTokenInformation
RegOpenCurrentUser
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
LsaNtStatusToWinError
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
oleaut32
SafeArrayGetVartype
SafeArrayCopy
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayCreate
VariantClear
VariantInit
SafeArrayDestroy
SysStringLen
VariantChangeType
SysAllocStringLen
SysAllocString
SysFreeString
Sections
.text Size: 346KB - Virtual size: 346KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 150KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE