Static task
static1
Behavioral task
behavioral1
Sample
7c65be4cf7fe9a4e8bd4391aaf02d4859e1d609311299070497269c15b6bbc69.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7c65be4cf7fe9a4e8bd4391aaf02d4859e1d609311299070497269c15b6bbc69.exe
Resource
win10v2004-20231215-en
General
-
Target
7c65be4cf7fe9a4e8bd4391aaf02d4859e1d609311299070497269c15b6bbc69
-
Size
575KB
-
MD5
d61a1948a5f0b33b7edd48e489408c36
-
SHA1
e8d67661efd121b46805cae2e82817148f9c82ff
-
SHA256
7c65be4cf7fe9a4e8bd4391aaf02d4859e1d609311299070497269c15b6bbc69
-
SHA512
d8057e3b7b7fe6efb145446772d77ca4fae0f22a76b72626f4c0f7c0efc59b8fffbeb00819c281a8e72c48cf9abb018c526f19e592f3ebb381c7b068086783d5
-
SSDEEP
12288:GnGA05mx8XUFdRRAlDeeab8kiIjjyHFqJuXR:GGA8mmXllD/qiIjjyHFlX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7c65be4cf7fe9a4e8bd4391aaf02d4859e1d609311299070497269c15b6bbc69
Files
-
7c65be4cf7fe9a4e8bd4391aaf02d4859e1d609311299070497269c15b6bbc69.exe windows:6 windows x86 arch:x86
4855f9f01182430f0971a84aac28d8b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WritePrivateProfileStringW
OutputDebugStringW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetCurrentThreadId
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSectionEx
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
lstrcmpiW
MultiByteToWideChar
DecodePointer
SetLastError
CloseHandle
SetEvent
CreateEventW
GetTickCount
GetStartupInfoW
GetPrivateProfileIntW
FindResourceW
WriteConsoleW
FlushFileBuffers
SizeofResource
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetStdHandle
ExitProcess
GetModuleHandleExW
ExitThread
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointerEx
GetFileType
RtlUnwind
CreateFileW
SetEnvironmentVariableA
HeapDestroy
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetStringTypeW
DuplicateHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetExitCodeThread
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
DeleteFileW
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
user32
wsprintfW
GetMessageW
TranslateMessage
LoadCursorW
FindWindowW
SetWindowLongW
GetWindowLongW
SetTimer
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
CharNextW
UnregisterClassW
PeekMessageW
DispatchMessageW
advapi32
RegDeleteKeyW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
shell32
SHGetSpecialFolderPathW
ord165
ole32
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
urlmon
URLDownloadToFileW
URLDownloadToCacheFileW
Sections
.text Size: 274KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ