Static task
static1
Behavioral task
behavioral1
Sample
0d356ed3350749238d4b7e34e8342d03.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d356ed3350749238d4b7e34e8342d03.exe
Resource
win10v2004-20231215-en
General
-
Target
0d356ed3350749238d4b7e34e8342d03
-
Size
130KB
-
MD5
0d356ed3350749238d4b7e34e8342d03
-
SHA1
327fc4d263bedcedd03ee53a5a3f52eef19fc47a
-
SHA256
5cac6b44432f9270b6785cdd5395f82d9d18d654663abdc353041b1d39b5b759
-
SHA512
153ed7994c63d7a7c35fbb1171538c17a4cdad6f4e658b2d728d0c4d031dafb87069b1d8b73e777f258e05bcee17db9a697f567494e905905e21fe3ff82ea525
-
SSDEEP
1536:qIiEsQfpQHayRAIwHDKkNdZxR4OdVzUg48Fq4MKrlZl0rJBD8m/:qNEsQSnRlHiL46VzUAFqPG0N3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d356ed3350749238d4b7e34e8342d03
Files
-
0d356ed3350749238d4b7e34e8342d03.exe windows:4 windows x86 arch:x86
81b90d6be6abff9c7775735683c1e1fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
CreateThread
ReleaseMutex
GetModuleHandleA
FindAtomA
lstrlenA
SearchPathA
FindVolumeClose
FindClose
GetLastError
FindResourceExA
TlsGetValue
GetDiskFreeSpaceA
SetEvent
ExitProcess
DeleteCriticalSection
Sleep
GetConsoleFontSize
GetTickCount
CloseHandle
user32
DispatchMessageA
EndDialog
IsIconic
CopyImage
CloseWindow
CreateMenu
GetKeyState
DragDetect
EnableWindow
GetMessageA
CreateWindowExA
CopyIcon
DialogBoxParamA
GetScrollBarInfo
wshbth
WSHNotify
WSHJoinLeaf
WSHOpenSocket2
WSHIoctl
NSPStartup
advapi32
RegCloseKey
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 122KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sfbwloy Size: - Virtual size: 6KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE