Static task
static1
Behavioral task
behavioral1
Sample
418868319254095d4af0d4899acb022a.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
418868319254095d4af0d4899acb022a.exe
Resource
win10v2004-20231215-en
General
-
Target
418868319254095d4af0d4899acb022a
-
Size
629KB
-
MD5
418868319254095d4af0d4899acb022a
-
SHA1
4dc94841fc0d32ccbd91400343a80988544e4dba
-
SHA256
3ab17cb843dfc34cd58933f541f8b4fe34fd0f4c930626cefc2d1510457d9f54
-
SHA512
6b2a1a0bc929dbd85f3f0bfd7a4b19066feb8f69a721ea7c50b557d8fdc43809f736f2c36f9b327278bdd90b7659b0ff6d1209d9f0c88910ac420b4c3bdce8e3
-
SSDEEP
12288:f5TqBnNXJg5YWDTQ7EH5kSc4c2mRL9S2NCdvcgu1/OCEoBoT1V/akIi9r2lBy6:f5TqBnNZg78Fgu1/OC2v/ad
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 418868319254095d4af0d4899acb022a
Files
-
418868319254095d4af0d4899acb022a.exe windows:6 windows x86 arch:x86
e368f49c7b273821a20ce46de0756670
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
ShowWindow
GetAsyncKeyState
kernel32
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStdHandle
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
TlsAlloc
TlsSetValue
InitializeCriticalSectionAndSpinCount
DeleteFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
GetFileAttributesExW
FlushFileBuffers
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameW
ExitProcess
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
GetEnvironmentVariableA
WaitForSingleObjectEx
CloseHandle
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
Sleep
GetTickCount
QueryPerformanceCounter
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
DeleteCriticalSection
SleepEx
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageW
SetLastError
GetLastError
GetConsoleWindow
HeapSize
TlsGetValue
IsDebuggerPresent
WriteConsoleW
RtlUnwind
RaiseException
normaliz
IdnToAscii
ws2_32
gethostname
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
accept
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
select
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
Sections
.text Size: 493KB - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ