Static task
static1
Behavioral task
behavioral1
Sample
5f830b8ba00e4549fde8c2519091da7d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5f830b8ba00e4549fde8c2519091da7d.exe
Resource
win10v2004-20231215-en
General
-
Target
5f830b8ba00e4549fde8c2519091da7d
-
Size
317KB
-
MD5
5f830b8ba00e4549fde8c2519091da7d
-
SHA1
d0ddd7b00f2ebb5008f4e75337d3017f179fdd49
-
SHA256
e1b5ceedd53db7049eea01121eda602932b26b3d50c8ea4024aafa112b286412
-
SHA512
e207ec7b4e282dbe57efd1f1131bbfc323c1b9299c0d0345578a0afc6e24263b29142ff2d705641b8c3d66755eec242ca1725c9e7ac8e6a9ed2049d095e2b61e
-
SSDEEP
6144:or2WeC/4nXA13lwjbjHMGcnr6hDLCF1bzzFD5BrOSMInBOwUsD1N:orenX5Hrlcnr6hDLstzzYSMaBOwUsRN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f830b8ba00e4549fde8c2519091da7d
Files
-
5f830b8ba00e4549fde8c2519091da7d.exe windows:4 windows x86 arch:x86
bc7db5f53f8c801474b0a9375b3aa600
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetOEMCP
LoadLibraryExA
lstrcpyA
LoadResource
SetConsolePalette
CloseHandle
IsBadCodePtr
GlobalAddAtomA
GlobalFree
VirtualProtect
GetStdHandle
FreeConsole
HeapCreate
GlobalAddAtomA
EnterCriticalSection
RaiseException
DeleteAtom
GlobalUnlock
WriteProfileStringA
GetLastError
user32
GetForegroundWindow
GetWindowTextA
AlignRects
GetDC
GetWindow
GetClassInfoExA
ValidateRect
IsIconic
GetClassNameA
CloseWindow
DrawEdge
GetFocus
GetWindowTextLengthA
ShowWindow
GetParent
ReleaseDC
EndPaint
GetActiveWindow
BeginPaint
mprapi
MprAdminUserRead
MprAdminUserWrite
MprAdminUserGetInfo
MprAdminUserOpen
MprAdminUserClose
linkinfo
CreateLinkInfoA
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 700KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ