Static task
static1
Behavioral task
behavioral1
Sample
c7ee41d9d24aec8333ea56f2d7a7b368.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c7ee41d9d24aec8333ea56f2d7a7b368.exe
Resource
win10v2004-20231215-en
General
-
Target
c7ee41d9d24aec8333ea56f2d7a7b368.exe
-
Size
316KB
-
MD5
c7ee41d9d24aec8333ea56f2d7a7b368
-
SHA1
4d44372b5f93192d9c8527e301b68a48dffeed40
-
SHA256
6739b519f402f11573adaafa9d86bd7cf08d880f00a2601e122bb872534dbaf5
-
SHA512
05851888f7860d04719a1a114c8bdd3079d4e301f44ac96c3801a4a7595dab9eb16786cc4f99115e1f6d12f7f04a717054973355b267c45a9a388fb8caf2c43c
-
SSDEEP
6144:M9r8eFDJSkvkVQxicea3+WwYKtOvreRNr:M9BGukVvrtOviR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c7ee41d9d24aec8333ea56f2d7a7b368.exe
Files
-
c7ee41d9d24aec8333ea56f2d7a7b368.exe.exe windows:5 windows x86 arch:x86
20d9789eab84c00389f370a41b11aca9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DebugActiveProcess
LocalUnlock
SetThreadContext
CommConfigDialogA
DebugActiveProcessStop
ConvertThreadToFiber
GlobalAddAtomA
InterlockedIncrement
ReadConsoleA
GetConsoleAliasA
HeapFree
GetEnvironmentStringsW
WriteConsoleInputA
SleepEx
GetFileAttributesExA
GetModuleHandleW
GetTickCount
GetCompressedFileSizeW
GetCommandLineA
GetConsoleCP
GlobalAlloc
SetFileShortNameW
LoadLibraryW
GetLocaleInfoW
ReadFileScatter
SetVolumeMountPointA
DeleteVolumeMountPointW
GlobalFlags
GetModuleFileNameW
FlushFileBuffers
GetShortPathNameA
GetNamedPipeHandleStateW
FindFirstFileA
GetCPInfoExW
GetLastError
GetCurrentDirectoryW
SetLastError
SetComputerNameA
WriteConsoleA
OpenWaitableTimerW
FoldStringA
FindNextFileA
FindFirstVolumeMountPointA
UpdateResourceW
VirtualProtect
GetCPInfoExA
GetWindowsDirectoryW
GetProfileSectionW
CloseHandle
ReadFile
WriteConsoleW
SetStdHandle
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MoveFileA
WideCharToMultiByte
DeleteFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
MultiByteToWideChar
GetCPInfo
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapCreate
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
SetFilePointer
HeapSize
ExitProcess
WriteFile
FreeEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
GetConsoleMode
CreateFileW
user32
CharUpperBuffW
RegisterClassW
CharToOemBuffW
GetNextDlgTabItem
Sections
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 46.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ