Static task
static1
Behavioral task
behavioral1
Sample
5ae65c548521589df4efb1c71b107d2d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5ae65c548521589df4efb1c71b107d2d.exe
Resource
win10v2004-20231215-en
General
-
Target
5ae65c548521589df4efb1c71b107d2d
-
Size
267KB
-
MD5
5ae65c548521589df4efb1c71b107d2d
-
SHA1
c8d30ffa1307852e7df5a6f8a7f47ab601d2b884
-
SHA256
0a9e503337c9ffe39b71a45fc9bc798aabe2044a2256d6c9f905526b647211fa
-
SHA512
271556b295f61457cadffb502a1f435ffa1391e94c11720820a2051b47bc02edf8a815ed45457d1173018bad083ca25042e27ba252531faec95092ec98029f58
-
SSDEEP
6144:t2UlB9K1QfaB+CcGTuuov3E5dfN4mPVAA:thlBJCbcotov3E5dlbPVV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ae65c548521589df4efb1c71b107d2d
Files
-
5ae65c548521589df4efb1c71b107d2d.exe windows:5 windows x86 arch:x86
1aa3fee556e69c1c83f043fa7f44e772
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileA
FindClose
RemoveDirectoryA
GetFileAttributesA
CopyFileA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateEventA
SetEvent
LoadLibraryA
GetComputerNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OpenEventA
GetModuleFileNameA
Sleep
OutputDebugStringA
SetErrorMode
CreateMutexA
IsDebuggerPresent
ExitProcess
SetFilePointer
WritePrivateProfileStringA
CreateFileMappingA
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetStdHandle
LoadLibraryW
IsValidLocale
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteFile
TerminateProcess
GetCurrentProcess
SetLastError
ReadFile
GetFileSize
FindFirstFileA
SetFileAttributesA
DeleteFileA
CreateFileA
GetModuleHandleA
CloseHandle
GetProcAddress
LocalFree
GetLocalTime
GetLastError
WaitForSingleObject
GetUserDefaultLangID
GetTickCount
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
CreateDirectoryA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryW
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
HeapCreate
GetStartupInfoW
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetModuleHandleW
HeapSize
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
ExitThread
ResumeThread
CreateThread
HeapReAlloc
HeapAlloc
HeapFree
GetDriveTypeW
GetFullPathNameA
GetSystemTimeAsFileTime
MoveFileA
GetCurrentThreadId
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
UnhandledExceptionFilter
user32
PeekMessageA
TranslateMessage
EnumDisplayMonitors
GetMonitorInfoA
EnumDisplaySettingsA
GetSystemMetrics
DispatchMessageA
advapi32
CloseServiceHandle
OpenServiceA
OpenSCManagerA
GetExplicitEntriesFromAclA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
GetAce
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
LookupAccountNameA
CopySid
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ws2_32
inet_addr
closesocket
WSAGetLastError
recvfrom
setsockopt
bind
htons
socket
gethostbyname
connect
ioctlsocket
select
htonl
listen
accept
recv
send
WSAStartup
inet_ntoa
gethostname
sendto
wininet
InternetCrackUrlA
shlwapi
PathFileExistsA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ