Static task
static1
Behavioral task
behavioral1
Sample
26800ed39d0e0fa6fdc5861290136bde.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
26800ed39d0e0fa6fdc5861290136bde.exe
Resource
win10v2004-20231222-en
General
-
Target
26800ed39d0e0fa6fdc5861290136bde
-
Size
392KB
-
MD5
26800ed39d0e0fa6fdc5861290136bde
-
SHA1
3968f9c54dfbd9a3b33b5c96f631c776be2d8fd7
-
SHA256
ea940086e9cf7798474bbb969b350073f31f43d171b4f228d9b6dc1360ffdc48
-
SHA512
cf8cc9a2054467c46b675b4839e47efa776b17d7b3c4612b2836211d529ab3bd0df7e3868705aeba2cf4bc5716ef8b9603d01f6fe4fa9607689afd34616f7f30
-
SSDEEP
6144:flUP41wG0fljKQIZhzc7HVHtf5vuyh+ajZCsuAMXMzFHCD/yr07oAH4rLKk0WNh:fB/ApUvsfRh+ajZCBAMXoUK0VHmKk0Ch
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26800ed39d0e0fa6fdc5861290136bde
Files
-
26800ed39d0e0fa6fdc5861290136bde.exe windows:4 windows x86 arch:x86
44b3054ee0baecb39f0ed7c33c667278
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalUnlock
GetModuleHandleA
SetConsoleCursorInfo
UnmapViewOfFile
FindClose
ReleaseMutex
GlobalFree
ExitThread
CreateMutexA
TlsGetValue
HeapDestroy
GetLastError
FindResourceA
GetEnvironmentVariableA
GetProcessHeap
CreateFileA
GetACP
LoadLibraryExW
HeapCreate
SetLastError
user32
DefWindowProcW
GetDC
GetIconInfo
DrawMenuBar
DispatchMessageA
GetDlgItem
FillRect
CopyRect
GetFocus
CallWindowProcA
CheckRadioButton
IsWindow
DrawEdge
uxtheme
GetThemeSysInt
DrawThemeIcon
DrawThemeText
DrawThemeEdge
GetThemeRect
clbcatq
SetupOpen
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ