Static task
static1
Behavioral task
behavioral1
Sample
2b79e25086d0e68a8f60b2bcc2410b2c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2b79e25086d0e68a8f60b2bcc2410b2c.exe
Resource
win10v2004-20231215-en
General
-
Target
2b79e25086d0e68a8f60b2bcc2410b2c
-
Size
26KB
-
MD5
2b79e25086d0e68a8f60b2bcc2410b2c
-
SHA1
53f12931be017412795e08837ca0611a2622ef92
-
SHA256
5012eba406393a1629d49f6ebf388775ebc65486ff24c58139f9e3468ca4c1c3
-
SHA512
9949ca5999a1f5a4d175d10203495a8737ceae96eb8a9e3ab51111c3c3b33c763512615d0b6f755fa60d1422a450a5fd75e2ae3a7623584420fd371fd0863e7a
-
SSDEEP
192:BX0jiIfSNyqu1bamZQDolIu8EF/ZKvgnrGUOMQrWYOyzRh79j:aiLNydwMlIu8c/ZsgrtOL5Rrj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b79e25086d0e68a8f60b2bcc2410b2c
Files
-
2b79e25086d0e68a8f60b2bcc2410b2c.exe windows:4 windows x86 arch:x86
bbeec381ef4fead399c53c0750caa1d0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryExW
GetConsoleMode
HeapCreate
CreateMutexA
GlobalUnlock
GetStdHandle
SetLastError
TerminateThread
TlsGetValue
lstrlenW
GetModuleHandleA
Sleep
GetCurrentThreadId
CloseHandle
FindResourceA
SetEnvironmentVariableA
PulseEvent
LocalFree
CreateFileA
ReleaseMutex
user32
CallWindowProcA
DrawMenuBar
DrawEdge
CopyRect
SetFocus
FillRect
GetDC
CheckRadioButton
GetIconInfo
DispatchMessageA
IsWindow
GetDlgItem
GetClipCursor
apphelp
SdbCloseDatabase
SdbGetDatabaseID
SdbFindFirstTag
ApphelpCheckIME
SdbFindNextTag
clbcatq
ComPlusMigrate
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dnislez Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE