Static task
static1
Behavioral task
behavioral1
Sample
c11beb70bd37c5714b6687af5e46b214.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c11beb70bd37c5714b6687af5e46b214.exe
Resource
win10v2004-20231215-en
General
-
Target
c11beb70bd37c5714b6687af5e46b214
-
Size
1.3MB
-
MD5
c11beb70bd37c5714b6687af5e46b214
-
SHA1
3f42a855fa78cfe0491ad5a96698906aa021976b
-
SHA256
5a054310382a72285171d2f08562386d810ee9b4d59c36fbb066228db17f2c02
-
SHA512
582a94ad093218f87ce236bd0437acb8ccaea3a6680eb6f51385adbebdf66a371c6f5de511a4dc6588058bbaad4d7aeac772c58fe3e12342ff38f865c6175a2a
-
SSDEEP
24576:dCL9ooe/8IO7V4zyYQYH300qyF2s/dRR2NHOye9u8Q/MxUAmsVK0momspPmtbqqQ:8Gh/iV47QYH3zp1RIlXepQ/MxUAmsVK+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c11beb70bd37c5714b6687af5e46b214
Files
-
c11beb70bd37c5714b6687af5e46b214.exe windows:5 windows x86 arch:x86
b027acff32be379f89ce44567c559ae4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileW
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
RaiseException
DecodePointer
DeleteCriticalSection
GetModuleHandleW
WaitForSingleObject
GetSystemDirectoryW
CreateProcessW
GetExitCodeProcess
LoadLibraryExW
CreateFileW
DeleteFileW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetCurrentThreadId
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
SleepEx
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetCommandLineW
GetCurrentProcess
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ReadConsoleW
WriteConsoleW
MoveFileExW
SetFilePointer
WriteFile
GetFileSize
CloseHandle
ReadFile
GetLastError
FindClose
FindNextFileW
FreeLibrary
GetProcAddress
LoadLibraryW
VirtualAlloc
GetDiskFreeSpaceA
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
GetModuleFileNameW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetStdHandle
GetACP
GetFileType
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExA
VirtualFree
advapi32
SystemFunction036
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetKeySecurity
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
CommandLineToArgvW
SHGetFolderPathW
shlwapi
SHDeleteKeyW
PathUnquoteSpacesW
PathQuoteSpacesW
StrCmpNW
PathRemoveBackslashW
PathFileExistsW
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ