Static task
static1
Behavioral task
behavioral1
Sample
f3c70ec32049139737226c85a87d453ac98c6a0ffc7747ba4f65118a1b8ef670.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f3c70ec32049139737226c85a87d453ac98c6a0ffc7747ba4f65118a1b8ef670.exe
Resource
win10-20231215-en
General
-
Target
f3c70ec32049139737226c85a87d453ac98c6a0ffc7747ba4f65118a1b8ef670
-
Size
1.9MB
-
MD5
ee1049d8f8248d11080582fe27f96843
-
SHA1
6701ba82ece6878c61fce5204def8efdc28822ab
-
SHA256
f3c70ec32049139737226c85a87d453ac98c6a0ffc7747ba4f65118a1b8ef670
-
SHA512
f8db9e2e7e0dec1f95b83e52f67b15c0e93fcba0801d220db43c23d732a2bb298e986fd65493019f3fed9bbc840032ff5f5c9ae3df6a025c596622b34757dea6
-
SSDEEP
49152:itCW0MSJfxkfBNec7L3jdHWNefneKAIBvxlRF1E:itz0MiOfbD79HWNeeKDtn1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3c70ec32049139737226c85a87d453ac98c6a0ffc7747ba4f65118a1b8ef670
Files
-
f3c70ec32049139737226c85a87d453ac98c6a0ffc7747ba4f65118a1b8ef670.exe windows:5 windows x86 arch:x86
a8b1db0ded57c5db8f40c241ff0d98f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DebugActiveProcess
LocalUnlock
SetThreadContext
CommConfigDialogA
DebugActiveProcessStop
ConvertThreadToFiber
GlobalAddAtomA
InterlockedIncrement
ReadConsoleA
GetConsoleAliasA
HeapFree
GetEnvironmentStringsW
WriteConsoleInputA
SleepEx
GetFileAttributesExA
GetModuleHandleW
GetTickCount
GetCompressedFileSizeW
GetCommandLineA
GetConsoleCP
GlobalAlloc
SetFileShortNameW
LoadLibraryW
GetLocaleInfoW
ReadFileScatter
SetVolumeMountPointA
DeleteVolumeMountPointW
GlobalFlags
GetModuleFileNameW
FlushFileBuffers
GetShortPathNameA
GetNamedPipeHandleStateW
FindFirstFileA
GetCPInfoExW
GetLastError
GetCurrentDirectoryW
SetLastError
SetComputerNameA
WriteConsoleA
OpenWaitableTimerW
FoldStringA
FindNextFileA
FindFirstVolumeMountPointA
UpdateResourceW
VirtualProtect
GetCPInfoExA
GetWindowsDirectoryW
GetProfileSectionW
CloseHandle
ReadFile
WriteConsoleW
HeapReAlloc
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MoveFileA
WideCharToMultiByte
DeleteFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapCreate
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
SetFilePointer
HeapSize
ExitProcess
WriteFile
FreeEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetConsoleMode
SetStdHandle
CreateFileW
user32
CharUpperBuffW
RegisterClassW
CharToOemBuffW
GetNextDlgTabItem
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.7MB - Virtual size: 48.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ