Static task
static1
Behavioral task
behavioral1
Sample
1576b0eed7cd85f46da082b648cb955d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1576b0eed7cd85f46da082b648cb955d.exe
Resource
win10v2004-20231222-en
General
-
Target
1576b0eed7cd85f46da082b648cb955d
-
Size
67KB
-
MD5
1576b0eed7cd85f46da082b648cb955d
-
SHA1
bdcb9ebf0df4ebfaa6ff161e2cc9d9fe8fc56aa4
-
SHA256
e783c2efd7150668272ea73609f75c98bfafb53142b002fec496a858f2c16fd8
-
SHA512
5840bc40a3f4bde3add3e2a13f84e20fa7d27c7789a0bed46ac6557229cd705fff96b17bc64967d00f683861c127d3dc8a95166f89b2117de322f4fd0d7fb4c9
-
SSDEEP
768:eRMbcp9y8zP5FJN0Z0bT68qEsulDhWBUvKf7hCOl2dA9o9aCgh1p7eechW74UEzn:xg6oN0eHR4vhCVA0s1p7edgYDTrxcZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1576b0eed7cd85f46da082b648cb955d
Files
-
1576b0eed7cd85f46da082b648cb955d.exe windows:5 windows x86 arch:x86
f5bccbbf7f1a1d6e89398844e9ddb93c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetCurrentProcess
SetFileTime
MoveFileA
SetFilePointer
SetEndOfFile
GetFileType
CreateFileA
CreateFileW
ReadFile
WriteFile
GetDriveTypeA
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
CloseHandle
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetVersionExA
GetCommandLineA
SetErrorMode
GetModuleFileNameA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByte
GetCPInfo
Sleep
GetStdHandle
GetConsoleMode
SetConsoleMode
FindClose
ReadConsoleA
user32
CharToOemBuffA
CharUpperA
wvsprintfA
OemToCharA
CharToOemA
OemToCharBuffA
LoadStringA
advapi32
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
SetFileSecurityW
AdjustTokenPrivileges
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ