Static task
static1
Behavioral task
behavioral1
Sample
78efeccd4126d7faa229e26b4cbc4f1e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
78efeccd4126d7faa229e26b4cbc4f1e.exe
Resource
win10v2004-20231215-en
General
-
Target
78efeccd4126d7faa229e26b4cbc4f1e
-
Size
701KB
-
MD5
78efeccd4126d7faa229e26b4cbc4f1e
-
SHA1
e5d4107f52a19780ec14bce4ac647db5153fe44d
-
SHA256
36ccfd60dd2b70959d5db4014333ba5b7aa99a9fb306a961b619bf003042eb38
-
SHA512
9f1f0ea0c392f98747475f54af3ebd9201b50bae71659105b6825902adf06e87931050cccadef461086b3bf5810a17fd96d5695b6d69f167708d91193c1e6868
-
SSDEEP
12288:TTRHXdAQtwygPWYgeWYg955/155/73fVuxZXaGEofwD9ombEe:vPAQttgQfVuxZK9ofk/bp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78efeccd4126d7faa229e26b4cbc4f1e
Files
-
78efeccd4126d7faa229e26b4cbc4f1e.exe windows:6 windows x64 arch:x64
30478b26cf0c721d4fa6a05bb5e5539c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetTokenInformation
GetLengthSid
ConvertSidToStringSidW
OpenProcessToken
IsValidSid
CopySid
kernel32
GetModuleFileNameA
HeapFree
GetCurrentProcess
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
LocalFree
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
RtlVirtualUnwind
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
OutputDebugStringW
RtlUnwindEx
InterlockedPushEntrySList
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
RtlUnwind
user32
MessageBoxA
shell32
ShellExecuteA
winhttp
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpReadData
WinHttpSendRequest
WinHttpSetOption
WinHttpOpen
WinHttpAddRequestHeaders
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
Sections
.text Size: 505KB - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ