Static task
static1
Behavioral task
behavioral1
Sample
6e290f6a03ebdb6a9a69a182f87814bc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e290f6a03ebdb6a9a69a182f87814bc.exe
Resource
win10v2004-20231215-en
General
-
Target
6e290f6a03ebdb6a9a69a182f87814bc
-
Size
13.6MB
-
MD5
6e290f6a03ebdb6a9a69a182f87814bc
-
SHA1
696826c3b5385b9982a5963de0bbc0685e85f085
-
SHA256
17deb21e95231597fca9df3dc5dcc68d66e46e088d30ae63ab80496ca93aa405
-
SHA512
ffaaec5a6c6022f9f12f7bf3dace85c8b6847fcc204edafd75a8f965de2f69cbdc4439787d6f8a9d33b33044f2ceda23e8e697439d9dcb8a72897b1f1a87d368
-
SSDEEP
1536:mgrtnQ0lULhZotkxdIvblp95RdfSYQnp9EI8JH+PhN06iWWzBWzBWzBWzBWzBWzI:Y0lULRxdIjr9bEYQfWePhN06
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e290f6a03ebdb6a9a69a182f87814bc
Files
-
6e290f6a03ebdb6a9a69a182f87814bc.exe windows:5 windows x86 arch:x86
816e07d7c149d21a4d07bdee1ab5223a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comsvcs
CoCreateActivity
RecycleSurrogate
advapi32
RegCreateKeyExA
CryptSignHashW
RegSaveKeyA
InitializeAcl
GetUserNameA
RegOpenKeyW
RegDeleteValueW
RegRestoreKeyA
ReadEventLogA
OpenEventLogW
RegEnumKeyA
authz
AuthzFreeContext
AuthzInitializeContextFromSid
AuthzAddSidsToContext
AuthzFreeAuditEvent
AuthzFreeResourceManager
clbcatq
CoRegCleanup
ComPlusMigrate
SetSetupSave
kernel32
AllocConsole
CreateFileW
ExitProcess
VirtualAllocEx
WaitForSingleObject
OpenEventA
LoadLibraryA
LoadLibraryExW
FindClose
GetACP
WriteFile
SetCurrentDirectoryA
GetFileAttributesW
VirtualQuery
GetCurrentDirectoryA
OpenSemaphoreA
GetVolumeNameForVolumeMountPointA
CreateJobObjectW
clusapi
CloseCluster
CloseClusterGroup
CloseClusterNode
ClusterControl
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.odata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.relo� Size: 13.5MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ