Static task
static1
Behavioral task
behavioral1
Sample
3c6e7a5ad0cb39932dc0f37017280b0f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c6e7a5ad0cb39932dc0f37017280b0f.exe
Resource
win10v2004-20231215-en
General
-
Target
3c6e7a5ad0cb39932dc0f37017280b0f
-
Size
493KB
-
MD5
3c6e7a5ad0cb39932dc0f37017280b0f
-
SHA1
5f07e232b6044bc051f491e270180a782b57a8e9
-
SHA256
79f3c93664502c51bb7cc18389034bbaac275f01824aa57b00ef8892564327db
-
SHA512
ca72c22bbf6596ca6b304254cbf8cd8d596ea85753148fa01bdf738feb1dac353af4586f8ae7f2a5eaa492dc19b613676b05956f77efafb225ee6b1d9572aaa2
-
SSDEEP
6144:aQpEHW6GfsInbMrWFkZW02jjk6wcPMORWTBAkQoPe8o0mYxVrc:Fp96GfkrFo02Xk8PJRWTyk3G8o5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c6e7a5ad0cb39932dc0f37017280b0f
Files
-
3c6e7a5ad0cb39932dc0f37017280b0f.exe windows:5 windows x86 arch:x86
33d9fa6a75379f0df1ec5aca53e5657e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
__WSAFDIsSet
closesocket
htons
gethostbyname
WSAStartup
WSACleanup
recvfrom
htonl
sendto
ntohl
ntohs
connect
recv
socket
send
gethostname
inet_addr
ioctlsocket
select
psapi
GetProcessImageFileNameA
EnumProcesses
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
kernel32
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
GetTickCount
Sleep
GetLastError
CreateMutexA
CloseHandle
CreateFileA
SetErrorMode
GetCurrentProcess
GlobalLock
GetLogicalDrives
WriteFile
GetDriveTypeA
OpenProcess
GlobalAlloc
Beep
TerminateProcess
GetEnvironmentVariableA
MultiByteToWideChar
GlobalUnlock
FindFirstFileA
CopyFileA
FindClose
MoveFileA
GetModuleFileNameA
WriteConsoleW
DeleteFileA
CreateThread
GetFileAttributesA
WaitForSingleObject
GetCurrentThread
TerminateThread
SetThreadPriority
ReleaseMutex
GetACP
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ReadFile
ExitProcess
GetFileType
GetStdHandle
SetHandleCount
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
SetStdHandle
GetExitCodeProcess
CreateProcessA
GetLocaleInfoW
GetProcessHeap
CreateFileW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
FindNextFileA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleW
user32
SetClipboardData
GetKeyState
GetAsyncKeyState
SendInput
DestroyWindow
EnumDesktopWindows
CloseClipboard
RegisterClassExA
SetForegroundWindow
SetFocus
SendMessageA
EnumWindows
GetForegroundWindow
GetWindowTextA
MapVirtualKeyA
SetCursorPos
GetClipboardData
CreateWindowExA
EmptyClipboard
SendMessageTimeoutA
GetDesktopWindow
BlockInput
ShowWindow
IsWindowVisible
OpenClipboard
SystemParametersInfoA
GetSystemMetrics
IsWindow
gdi32
CreateDIBSection
CreateDCA
DeleteDC
SelectObject
CreateCompatibleDC
GetDIBColorTable
GetDeviceCaps
BitBlt
DeleteObject
advapi32
GetUserNameA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ