Static task
static1
Behavioral task
behavioral1
Sample
1af605090d9b9490bbfd95cba815168f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1af605090d9b9490bbfd95cba815168f.exe
Resource
win10v2004-20231215-en
General
-
Target
1af605090d9b9490bbfd95cba815168f
-
Size
25KB
-
MD5
1af605090d9b9490bbfd95cba815168f
-
SHA1
1f9bc788b8d34e24a104145a89d876a53557808a
-
SHA256
77e1e3f977c565371b8e1e4c34cde477647be7fcd8d7effc1af794f308bbdd38
-
SHA512
714a040b4ea56fbc1a23ff099986c021aadc101e03181f0755f2cb768a6ee41e6d7663283c6a06705fa056ce3b1efc655e4f3961a3b0dfc762721f0198510e52
-
SSDEEP
384:QKa4VHfbFdkmRd8FOnTIeTHCgTBMzn+CXq7Fvn1j:Qz4V/bFembmOMeDC5z+iWFv1j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1af605090d9b9490bbfd95cba815168f
Files
-
1af605090d9b9490bbfd95cba815168f.exe windows:4 windows x86 arch:x86
77c35dfefdca30cd4d96c1b09ea987f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_ultoa
_itoa
memset
memcpy
msvcrt
rand
strtok
srand
kernel32
FindFirstFileA
Process32First
CreateProcessA
lstrcmpiA
TerminateProcess
GetProcAddress
VirtualAlloc
FindNextFileA
OpenProcess
ExitProcess
FindClose
lstrcatA
LoadLibraryA
CreateToolhelp32Snapshot
Sleep
Process32Next
FreeLibrary
GetTickCount
CreateEventA
WriteFile
CloseHandle
lstrlenA
HeapFree
SetNamedPipeHandleState
lstrcpyA
TransactNamedPipe
GetLastError
HeapSetInformation
ProcessIdToSessionId
GetCurrentProcessId
HeapAlloc
WaitNamedPipeA
GetVolumeInformationA
GetWindowsDirectoryA
GetSystemTime
CreateFileA
HeapCreate
user32
wsprintfA
advapi32
RegQueryValueExA
OpenSCManagerA
ControlService
CloseServiceHandle
ChangeServiceConfigA
OpenServiceA
RegOpenKeyA
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 140KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ