Static task
static1
Behavioral task
behavioral1
Sample
7a1a43615d35e7192dddcae7f39c6fab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7a1a43615d35e7192dddcae7f39c6fab.exe
Resource
win10v2004-20231215-en
General
-
Target
7a1a43615d35e7192dddcae7f39c6fab
-
Size
359KB
-
MD5
7a1a43615d35e7192dddcae7f39c6fab
-
SHA1
23d162ae801a0a92c20e0f15d244d9259bfaad7e
-
SHA256
344330cbd5ae71b47aea8528de4d6b05a3fe9276211290026c962ec2b388f417
-
SHA512
1a79b2e201d05ce29473965fa904ae926733cf7b83e298763a21751c6993815870b526a37a335887c1324f9e8bcb19601aa7ca0e7e2bd8d133fedae2bb5b5ca7
-
SSDEEP
6144:q3D7wTNXJR+MmGKC/MMyYtg5QcPS3Yz54HuLdynLsa9bvhYYc:6Q1+MSJYy3SIz9MnLh9bvO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a1a43615d35e7192dddcae7f39c6fab
Files
-
7a1a43615d35e7192dddcae7f39c6fab.exe windows:4 windows x86 arch:x86
b2203381da54ca0354619274f14cb3bc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
SetEvent
Sleep
GetStartupInfoA
GetLastError
DeleteCriticalSection
VirtualProtect
GetDiskFreeSpaceA
GetCalendarInfoA
CreateThread
ReleaseMutex
TlsGetValue
FindAtomA
SearchPathA
FindClose
GetTickCount
CloseHandle
FindVolumeClose
GetModuleHandleA
FindResourceExA
advapi32
RegLoadKeyA
RegEnumKeyExA
LsaSetSecret
RegCloseKey
CloseTrace
OpenEventLogA
CloseEventLog
LsaClose
RegCreateKeyExA
LsaFreeMemory
FreeSid
GetFileSecurityA
IsValidSid
AccessCheck
RegCloseKey
msdtcuiu
DtcPerfOpen
DllGetClassObject
DtcPerfCollect
DtcPerfClose
DllRegisterServer
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ