Static task
static1
Behavioral task
behavioral1
Sample
4b6d554fa56cd786b38ed91fa6ef08bc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b6d554fa56cd786b38ed91fa6ef08bc.exe
Resource
win10v2004-20231215-en
General
-
Target
4b6d554fa56cd786b38ed91fa6ef08bc
-
Size
600KB
-
MD5
4b6d554fa56cd786b38ed91fa6ef08bc
-
SHA1
578c611edaa6f7fe2585bc6ff492aed5a08bae87
-
SHA256
e80b6dbd3e07d3d1664a04fdbb1db97bd78e311f96e2e3df8de8bd9f09e3c976
-
SHA512
bf625c04d52d7b7f09d473efa840a29d552b80da66d5e2812f3a1cd955153b2b81756c81628380457f89572618c32e6d3eb2c4bb8d26fd0cceda6009ee8a4ace
-
SSDEEP
12288:5AwPnETc5kkr1hB1y9Fz3UbawgwYPOVAh7zA16slY47Ueai3xIBsZwZUXVPSCN3U:VnEgzhB1QFz3UbawgwYPOVAh7zA15Y4O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b6d554fa56cd786b38ed91fa6ef08bc
Files
-
4b6d554fa56cd786b38ed91fa6ef08bc.exe windows:5 windows x86 arch:x86
b0b87a9e51c407beeeaa38268f3833f0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
Sleep
CreateThread
GetModuleFileNameA
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
CloseHandle
WriteFile
CreateFileA
ReadFile
SetFilePointer
GetFileSize
GetSystemDirectoryA
MultiByteToWideChar
TransactNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
FreeLibrary
GetEnvironmentVariableW
GetProcAddress
LoadLibraryA
HeapFree
HeapAlloc
GetProcessHeap
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
WideCharToMultiByte
GetComputerNameA
CopyFileA
DeleteFileA
lstrcatA
GetCurrentProcess
TerminateProcess
WaitForSingleObject
GetCurrentProcessId
MoveFileA
TerminateThread
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
CreatePipe
SetConsoleCtrlHandler
GetLocaleInfoA
GetVersionExA
GetLogicalDrives
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GlobalMemoryStatus
CreateDirectoryA
GetDriveTypeA
GetLogicalDriveStringsA
RtlUnwind
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetCurrentThread
HeapValidate
IsBadReadPtr
SetHandleCount
GetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
LCMapStringA
LCMapStringW
RaiseException
FatalAppExitA
InterlockedExchange
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
HeapSize
HeapReAlloc
VirtualAlloc
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
GetStringTypeA
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
lstrlenA
SetEndOfFile
GetTimeZoneInformation
VirtualQuery
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sections
.text Size: 467KB - Virtual size: 467KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.toot Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ