Static task
static1
Behavioral task
behavioral1
Sample
1dd00cdc28a99b0357545e0a5108ea06.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
1dd00cdc28a99b0357545e0a5108ea06.exe
Resource
win10v2004-20231201-en
General
-
Target
1dd00cdc28a99b0357545e0a5108ea06
-
Size
2.0MB
-
MD5
1dd00cdc28a99b0357545e0a5108ea06
-
SHA1
54a3d2d0b3edf60ecccb31c7afa59cf2bf1032ff
-
SHA256
e8c96e0e79c4bf1126506d39391d67f2486ff59fc719d72eb2cbd776c8ea5e20
-
SHA512
05a046928ae3883fab37864d5fdf24255f29d60643a63903d12d33adea604f952a96fc0b8ebd3d0a5ffc916b4a9d851e2a5fc83d77960cbb28452589edfc0353
-
SSDEEP
49152:6+rMnI0JfbzXpZS7dFz+UjsHM63tWKBy53qdZ:6RI4jbp0dssUtnBM6n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1dd00cdc28a99b0357545e0a5108ea06
Files
-
1dd00cdc28a99b0357545e0a5108ea06.exe windows:5 windows x86 arch:x86
6701d15f9199126fb943b3d265131dfa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
gethostname
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
ioctlsocket
ntohl
kernel32
GetCurrentProcessId
FormatMessageA
GetTickCount
GetCurrentProcess
WaitForSingleObject
GetCurrentThreadId
Sleep
RaiseException
CreateThread
IsDebuggerPresent
ReadFile
GetCurrentDirectoryW
GetCommandLineW
GetModuleHandleExW
GetModuleHandleW
GetVersionExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
CreateFileW
SetEndOfFile
CloseHandle
SetFilePointerEx
FlushFileBuffers
FindFirstFileExW
FindNextFileW
FindClose
GetModuleHandleA
CreateEventW
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
LoadLibraryW
WaitForMultipleObjects
SetEvent
GetModuleFileNameW
WriteFile
DeleteCriticalSection
LeaveCriticalSection
VerifyVersionInfoW
GetSystemDirectoryW
VerSetConditionMask
PeekNamedPipe
SleepEx
ReadConsoleW
GetDriveTypeW
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
LoadLibraryExW
GetProcAddress
FreeLibrary
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
QueryPerformanceCounter
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
HeapFree
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
GetProcessHeap
LoadLibraryA
IsBadReadPtr
GetTimeZoneInformation
GetFullPathNameW
InitializeCriticalSection
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ExpandEnvironmentStringsA
GetStdHandle
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
OutputDebugStringW
RtlUnwind
GetConsoleCP
GetConsoleMode
ExitProcess
SetStdHandle
GetFileType
ExitThread
FreeLibraryAndExitThread
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
user32
GetSystemMetrics
MessageBoxA
advapi32
RegOpenCurrentUser
EnumServicesStatusW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptEncrypt
OpenSCManagerW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptImportKey
ole32
CoInitialize
shlwapi
PathRemoveFileSpecW
PathAppendW
wininet
HttpOpenRequestW
HttpQueryInfoW
InternetCrackUrlW
InternetCheckConnectionW
InternetOpenA
InternetCloseHandle
InternetConnectW
HttpSendRequestA
InternetReadFile
wldap32
ord142
ord167
ord127
ord27
ord26
ord79
ord41
ord208
ord216
ord14
ord46
ord145
ord301
ord147
ord118
ord133
Sections
.text Size: 628KB - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE