Static task
static1
Behavioral task
behavioral1
Sample
b6f4ce4c5a395b52a5dcb4fde20ebf49b55cd0ba631a0ea15e8bec91e5f7d388.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b6f4ce4c5a395b52a5dcb4fde20ebf49b55cd0ba631a0ea15e8bec91e5f7d388.exe
Resource
win10v2004-20231215-en
General
-
Target
b6f4ce4c5a395b52a5dcb4fde20ebf49b55cd0ba631a0ea15e8bec91e5f7d388
-
Size
8.6MB
-
MD5
39c3f148031f60ad47e354bd6414ebb2
-
SHA1
72559cde8988584d5802808e60f3214e86ce4152
-
SHA256
b6f4ce4c5a395b52a5dcb4fde20ebf49b55cd0ba631a0ea15e8bec91e5f7d388
-
SHA512
90b9bb9e6f5e65c419fe050232e2d95f82fd4acfd4071e95661d25598c9d502b611427dcbb6ba2b7e403bcb98214bace0b1c39e8872f05c152be4031bb4cda03
-
SSDEEP
196608:vcdqcGecoTIkqhFcy3mXBTjbYfAYguwx5+zod4igHR:O3GToTDq9ZfAYg1xoe4Jx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6f4ce4c5a395b52a5dcb4fde20ebf49b55cd0ba631a0ea15e8bec91e5f7d388
Files
-
b6f4ce4c5a395b52a5dcb4fde20ebf49b55cd0ba631a0ea15e8bec91e5f7d388.exe windows:6 windows x64 arch:x64
770857eb9acb43941ef6f2bea937d744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
GetComputerNameW
CloseHandle
GetCurrentProcess
GetCommandLineW
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineA
SetCurrentDirectoryW
GetModuleFileNameW
GetModuleHandleW
ReleaseMutex
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryExW
SetDllDirectoryW
GetThreadId
CreateFileW
SetFilePointer
WriteFile
Sleep
CopyFileW
VerSetConditionMask
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDrives
GetVersionExW
GetPhysicallyInstalledSystemMemory
GetModuleHandleA
LoadLibraryW
VerifyVersionInfoW
GetVolumePathNameA
WideCharToMultiByte
GetUserDefaultUILanguage
ReadFile
SetFilePointerEx
GetOverlappedResult
SetEnvironmentVariableW
TerminateProcess
WaitForMultipleObjects
GetCurrentProcessId
GetExitCodeProcess
GetVolumeInformationW
WaitForSingleObject
GetProcessId
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
CreateProcessW
SetThreadUILanguage
GetThreadUILanguage
GetUserDefaultLocaleName
SetLastError
GetCurrentDirectoryW
CreateDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
FormatMessageA
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MultiByteToWideChar
GetTempPathW
GetStartupInfoW
GetTickCount64
InitOnceBeginInitialize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetEnvironmentVariableA
GetEnvironmentVariableW
SetEnvironmentVariableA
GetFileAttributesW
GetSystemDefaultLocaleName
CompareFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
SetEvent
ReleaseSemaphore
CreateMutexA
CreateEventA
CreateThread
GetCurrentThread
GetCurrentThreadId
OpenThread
SetThreadPriority
SetThreadPriorityBoost
GetThreadPriority
ExitThread
ResumeThread
SetThreadIdealProcessor
GetProcessAffinityMask
SetThreadAffinityMask
CreateSemaphoreA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
VirtualQueryEx
WerSetFlags
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
AddVectoredExceptionHandler
SetPriorityClass
GetPriorityClass
LocalAlloc
Process32First
Process32Next
ExitProcess
GetDiskFreeSpaceExW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
ResetEvent
MoveFileExW
MoveFileWithProgressW
GetSystemDefaultUILanguage
GlobalAddAtomA
CreateFileA
DeleteFileA
ConnectNamedPipe
DisconnectNamedPipe
CancelIoEx
CreateNamedPipeA
GetVolumeInformationA
SetHandleInformation
CreatePipe
SetNamedPipeHandleState
CreateProcessA
GetWindowsDirectoryA
GetSystemFirmwareTable
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSection
GetSystemDirectoryW
GetFullPathNameW
OutputDebugStringW
GetStdHandle
GetFileType
SleepEx
GetVersion
LockFileEx
UnlockFileEx
FormatMessageW
TransactNamedPipe
CreateNamedPipeW
WaitNamedPipeW
FindFirstFileExW
GetFileTime
RtlPcToFileHeader
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleHandleExW
SetConsoleCtrlHandler
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
WriteConsoleW
InitOnceComplete
K32EnumProcesses
K32GetProcessImageFileNameA
LoadLibraryA
RemoveVectoredExceptionHandler
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 199KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CPADinfo Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 622KB - Virtual size: 622KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 29.6MB - Virtual size: 29.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ