Static task
static1
Behavioral task
behavioral1
Sample
0c9fc2bd2a992f402e91c7332a91cc51.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c9fc2bd2a992f402e91c7332a91cc51.exe
Resource
win10v2004-20231215-en
General
-
Target
0c9fc2bd2a992f402e91c7332a91cc51
-
Size
205KB
-
MD5
0c9fc2bd2a992f402e91c7332a91cc51
-
SHA1
5d1e529dc6ab2a0328746d7a054aab7ab89f1016
-
SHA256
42c61bbc41b18de5689a006f91675a33dc3d445c61bf26e9a553c3e9dca0d0f0
-
SHA512
7b3962553ed28f30885464273df85038f5a8f2fbf94b92d580f86617420141bd9374e1e43b4e9b0d7ea8292b88cfb86a715818086d0893158a918c0e44e4fc41
-
SSDEEP
6144:VQO09EYxk4qi3Wt3JhkaWjyxTUE5dYaOopu0:iVTxkx6e33kaWjyTGzK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c9fc2bd2a992f402e91c7332a91cc51
Files
-
0c9fc2bd2a992f402e91c7332a91cc51.exe windows:5 windows x86 arch:x86
b52cf2c743bfb71fa69c16695a772737
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
lstrcmpiA
lstrlenA
GetModuleFileNameA
lstrcmpA
GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
VirtualFree
UnmapViewOfFile
VirtualAlloc
CloseHandle
MapViewOfFileEx
CreateFileMappingA
OpenFileMappingA
LeaveCriticalSection
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
lstrcatA
lstrcpyA
FreeLibrary
TerminateThread
WaitForSingleObject
GetFileAttributesExA
ExpandEnvironmentStringsA
GetTickCount
lstrcpynA
DeleteCriticalSection
SearchPathA
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
Sleep
RtlUnwind
GetLastError
CreateThread
GetCurrentThreadId
ExitThread
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCommandLineA
GetStartupInfoA
HeapValidate
IsBadReadPtr
MultiByteToWideChar
ReadFile
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
FlushFileBuffers
HeapAlloc
HeapSize
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
SetStdHandle
InitializeCriticalSectionAndSpinCount
CreateFileA
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
user32
GetParent
advapi32
RegSetValueExA
RegCloseKey
RegCreateKeyExA
ole32
CoInitialize
Sections
.text Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE