Static task
static1
Behavioral task
behavioral1
Sample
1a9ef0a4e0da0c1057ffe7065a663f54.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1a9ef0a4e0da0c1057ffe7065a663f54.exe
Resource
win10v2004-20231215-en
General
-
Target
1a9ef0a4e0da0c1057ffe7065a663f54
-
Size
152KB
-
MD5
1a9ef0a4e0da0c1057ffe7065a663f54
-
SHA1
120895aa43e2f2e5b7a651d7fde50836fca6912b
-
SHA256
5e1beb911b7bdfe137c50e48bf83ce27b77579e0c205674803eef90d4499ef26
-
SHA512
95da8d7c08cd4fe7753acca75a75e999be87974f9ebff15ce09d5c46191073ca12f88b255cc4ad068178356257827faeb7f08c7785cc91846727d0a05491b85d
-
SSDEEP
3072:0zOQsFDni/byyff9PPHe2RWcOgHsbRofKS/l0+:Xnoby8fxRdstofKSe+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a9ef0a4e0da0c1057ffe7065a663f54
Files
-
1a9ef0a4e0da0c1057ffe7065a663f54.exe windows:4 windows x86 arch:x86
0397b925de67553611604afe70dfbd54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
SetProcessWorkingSetSize
GetCurrentProcess
lstrlenA
GetCurrentThreadId
GetModuleFileNameA
GetCommandLineA
WideCharToMultiByte
GetSystemDefaultLCID
lstrlenW
ExitProcess
SleepEx
LockResource
FreeLibrary
LoadLibraryA
ReleaseSemaphore
CloseHandle
WaitForSingleObject
CreateThread
CreateSemaphoreA
HeapCreate
GetProcAddress
GetLastError
WriteProcessMemory
OpenProcess
GetCurrentProcessId
GetVolumeInformationA
ReadFile
CreateFileA
EnumResourceNamesA
CompareStringA
SetEndOfFile
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetSystemInfo
LoadResource
FlushFileBuffers
SetStdHandle
SetFilePointer
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
GetCPInfo
GetOEMCP
LCMapStringW
LCMapStringA
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetFullPathNameA
HeapSize
TerminateProcess
IsBadWritePtr
HeapDestroy
VirtualQuery
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
HeapReAlloc
GetStartupInfoA
FindResourceA
CompareStringW
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExA
GetThreadLocale
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetEnvironmentVariableA
FindClose
RtlUnwind
HeapAlloc
GetProcessHeap
HeapFree
IsBadReadPtr
VirtualFree
VirtualProtect
VirtualAlloc
GetLocaleInfoA
GetACP
GetTimeZoneInformation
InterlockedExchange
user32
CreateWindowExA
IsWindow
MessageBoxA
PostQuitMessage
PostMessageA
GetMessageA
TranslateMessage
PostThreadMessageA
RegisterWindowMessageA
LoadStringA
SendMessageA
ShowWindow
SetWindowTextW
DispatchMessageA
SetFocus
MessageBoxW
LoadImageA
LoadIconA
EnableWindow
GetSystemMetrics
SetClassLongA
SetWindowTextA
FindWindowA
SetForegroundWindow
CallNextHookEx
GetClassNameA
ole32
CoInitialize
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
oleaut32
SafeArrayCreate
SysAllocStringLen
SafeArrayDestroy
SafeArrayRedim
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocString
VariantCopy
SafeArrayCopy
SysFreeString
VariantInit
VariantClear
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
shlwapi
StrStrIA
StrCmpIW
comctl32
ord410
ord413
ord412
psapi
GetModuleBaseNameA
ws2_32
WSAStartup
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE