?SPVersion@@3PADA
Static task
static1
Behavioral task
behavioral1
Sample
48add7a462e27c4b57f6cd4a8703fbc0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48add7a462e27c4b57f6cd4a8703fbc0.exe
Resource
win10v2004-20231215-en
General
-
Target
48add7a462e27c4b57f6cd4a8703fbc0
-
Size
707KB
-
MD5
48add7a462e27c4b57f6cd4a8703fbc0
-
SHA1
228d4e4a3b9492cdd1154da75e009f13e0e6e174
-
SHA256
56e908b6d78056335982595631538d77cbd1cbe701f36eefce3637c4140cc5cb
-
SHA512
59128cfdd799f6d57ca822be3146c79415cc0f2fd28e74686ce35b0777417f90a79fc95559e3c0bcfc47d7ab980c6cd00665c6dadff3e452d4de6119f0ac1396
-
SSDEEP
12288:eFwO2FIk9rs2m84Hz+6/STWZH8oN7Dk0oVKDX2D:eOO2FIke2m84Tj/SToHhk0rG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48add7a462e27c4b57f6cd4a8703fbc0
Files
-
48add7a462e27c4b57f6cd4a8703fbc0.exe windows:6 windows x86 arch:x86
fc534c345d840d68c82732c4eccff4e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlUnwind
advapi32
CryptDuplicateKey
CryptSetHashParam
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptDecrypt
CryptDeriveKey
CryptEncrypt
CryptGenRandom
CryptImportKey
CryptGetDefaultProviderW
CryptGetProvParam
RegCloseKey
RegQueryValueExW
RegOpenKeyExA
CryptReleaseContext
CryptAcquireContextW
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
CryptVerifySignatureA
CryptSetKeyParam
CryptGetKeyParam
kernel32
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
HeapAlloc
GetCPInfo
GetACP
WriteFile
Sleep
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetSystemDirectoryW
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
VirtualProtect
GetSystemInfo
VirtualQuery
GetSystemTime
LocalFree
CreateMutexA
ReleaseMutex
CloseHandle
CreateFileW
WaitForSingleObject
DeleteFileW
SetFilePointer
ReadFile
RaiseException
GetVolumeInformationA
GetDriveTypeA
lstrlenA
GetLogicalDriveStringsA
DeviceIoControl
CreateFileA
GetProcessHeap
QueryDosDeviceW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
LoadLibraryW
GetSystemWindowsDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
GetVersion
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
ExitProcess
GetModuleHandleA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetProcAddress
SetUnhandledExceptionFilter
GetVersionExA
GetCommandLineA
LocalAlloc
GetOEMCP
HeapSize
GetConsoleCP
GetConsoleMode
GetStringTypeW
msdrm
__AddMachineCertToLicenseStore
DRMGetClientVersion
crypt32
CryptProtectData
ole32
CoCreateGuid
shfolder
SHGetFolderPathW
Exports
Exports
Sections
.text Size: 445KB - Virtual size: 444KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PACK Size: 160KB - Virtual size: 424KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE