Static task
static1
Behavioral task
behavioral1
Sample
e1c399c29b9379f9d1d3f17822d4496fce8a5123f57b33f00150f287740049e9.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
e1c399c29b9379f9d1d3f17822d4496fce8a5123f57b33f00150f287740049e9.exe
Resource
win10v2004-20231127-en
General
-
Target
e1c399c29b9379f9d1d3f17822d4496fce8a5123f57b33f00150f287740049e9
-
Size
1.1MB
-
MD5
4c7d2ec42f5b225982d9e2e96383a2fd
-
SHA1
6edc8db346032a83402d7104c5783cc1e929e402
-
SHA256
e1c399c29b9379f9d1d3f17822d4496fce8a5123f57b33f00150f287740049e9
-
SHA512
c83cd4b6394a2629ab7148cf1db73ae040d247809660e34ec895cee37af56e655f99db0eb88711d206407076b949dd5f5e4dad3be9f272bf2b7985575e147861
-
SSDEEP
12288:TUOEh1CfIQ9wcSEzPXgFSuYxZyJhLA/3lqYV1lYT/S:oOq1cwcnjXgFSuYxZy72kYV1lYT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1c399c29b9379f9d1d3f17822d4496fce8a5123f57b33f00150f287740049e9
Files
-
e1c399c29b9379f9d1d3f17822d4496fce8a5123f57b33f00150f287740049e9.exe windows:6 windows x64 arch:x64
Password: threatbook
5361c5aa96802abd7c2d73055f958afa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
RegOpenKeyExW
RegSetValueExW
RegCloseKey
kernel32
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
IsDebuggerPresent
GetFullPathNameW
SetFileInformationByHandle
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetModuleHandleW
DuplicateHandle
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
GetSystemTimeAsFileTime
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
MoveFileExW
CreateSymbolicLinkW
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
RtlLookupFunctionEntry
GetEnvironmentVariableW
ReleaseMutex
GetCurrentProcess
CreateMutexA
GetCurrentProcessId
LoadLibraryA
WaitForSingleObjectEx
GetCurrentDirectoryW
SetLastError
WriteConsoleW
MultiByteToWideChar
UnhandledExceptionFilter
WaitForSingleObject
SetUnhandledExceptionFilter
GetConsoleMode
GetStdHandle
TryAcquireSRWLockExclusive
GetCurrentThread
GetProcAddress
GetModuleHandleA
GetSystemInfo
WakeConditionVariable
SleepConditionVariableSRW
SwitchToThread
HeapReAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
SetFilePointerEx
Sleep
WakeAllConditionVariable
FindClose
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
FormatMessageW
GetFileAttributesW
IsProcessorFeaturePresent
user32
MessageBoxW
SystemParametersInfoW
ntdll
NtWriteFile
RtlNtStatusToDosError
NtReadFile
vcruntime140
memcmp
memcpy
memset
__CxxFrameHandler3
memmove
__current_exception_context
__C_specific_handler
__current_exception
api-ms-win-crt-runtime-l1-1-0
_c_exit
_initialize_onexit_table
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_cexit
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_register_onexit_function
_crt_atexit
terminate
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Sections
.text Size: 508KB - Virtual size: 507KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ