Static task
static1
Behavioral task
behavioral1
Sample
6c79746a65da455e5520b18ea98c27c84a9dd6574218d358a81dc4dcee779b79.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6c79746a65da455e5520b18ea98c27c84a9dd6574218d358a81dc4dcee779b79.exe
Resource
win10v2004-20231215-en
General
-
Target
6c79746a65da455e5520b18ea98c27c84a9dd6574218d358a81dc4dcee779b79
-
Size
36KB
-
MD5
2a761266dbf37aefcc9097b82e46c6e2
-
SHA1
12a236fa69660c4c509cbe0e7cc6040604d99244
-
SHA256
6c79746a65da455e5520b18ea98c27c84a9dd6574218d358a81dc4dcee779b79
-
SHA512
a99f596a42ea21fcfcd697947abf33efcd698d398b8496ffeb2c03953bc228e553dc89ff2f6be41797ccddbe842a90f46fa3cf0496898f3c751414d9fb029e95
-
SSDEEP
768:q/2jbx8IL4RQM82X1a54GL1MdS4o8BWPKbKqBuaH6:e2p8U4Rz82E54GmS4oqizn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6c79746a65da455e5520b18ea98c27c84a9dd6574218d358a81dc4dcee779b79
Files
-
6c79746a65da455e5520b18ea98c27c84a9dd6574218d358a81dc4dcee779b79.exe windows:6 windows x64 arch:x64
8db98600cf1505421bb05d01d8d7116c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
TerminateProcess
InitializeCriticalSectionEx
ResumeThread
GetLastError
CloseHandle
GetThreadContext
DeleteCriticalSection
CreateProcessW
SetThreadContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlCaptureContext
shell32
ShellExecuteW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
wininet
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
InternetOpenW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
_CxxThrowException
__std_exception_destroy
_local_unwind
memchr
__current_exception
__current_exception_context
memset
__std_exception_copy
memmove
memcpy
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsscanf
__p__commode
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
__p___argv
_exit
_get_initial_narrow_environment
_register_onexit_function
_set_app_type
_seh_filter_exe
exit
__p___argc
terminate
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_crt_atexit
_cexit
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
calloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ