Static task
static1
Behavioral task
behavioral1
Sample
6552159a8399d341c4104be63045ef4b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6552159a8399d341c4104be63045ef4b.exe
Resource
win10v2004-20231215-en
General
-
Target
6552159a8399d341c4104be63045ef4b
-
Size
329KB
-
MD5
6552159a8399d341c4104be63045ef4b
-
SHA1
e2de5a00c165df4d5b96b016ba7626dd8d22cb40
-
SHA256
21a029589f9c6d5de13ff4ba28bfd5b81c753302fca2b50a1895bfb7ad8ecbf0
-
SHA512
cc3894490e165b7a151486be14da334843d6a4f05e0d127ffe0ebee91cf92f9eb4b5d22c21911594984b81aefe5393da7294e35b49c149556dbb79f5c5defaef
-
SSDEEP
6144:MV/cpm7L0zOSuBLbii5bkgVuN+xSKV7Wkrsf7LskpqS06oGYR9Bc:MVEeLgfcXikbkgaISKVsoP9Bc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6552159a8399d341c4104be63045ef4b
Files
-
6552159a8399d341c4104be63045ef4b.exe windows:5 windows x86 arch:x86
d431b5037a9a54c9815e57ab3240c0f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
CreateDirectoryA
GetProcAddress
LoadLibraryA
SetEnvironmentVariableA
GetModuleFileNameA
FindResourceA
LoadResource
SizeofResource
LockResource
WaitForSingleObject
OpenProcess
GetExitCodeProcess
TerminateProcess
GetProcessId
CloseHandle
ReadFile
SetEndOfFile
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
OutputDebugStringW
HeapReAlloc
LoadLibraryExW
LCMapStringW
EncodePointer
DecodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
EnterCriticalSection
LeaveCriticalSection
HeapFree
RaiseException
HeapAlloc
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
GetConsoleCP
GetConsoleMode
GetStringTypeW
ReadConsoleW
shell32
SHFileOperationA
ord680
ShellExecuteExA
pdh
PdhMakeCounterPathA
PdhOpenQueryA
PdhAddCounterA
PdhGetRawCounterValue
PdhCollectQueryData
PdhCloseQuery
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ