Static task
static1
Behavioral task
behavioral1
Sample
a9b078f57cf9e6fac6441e20e6ec4193fc8268d679ccbafb9ec0e50781357b3b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a9b078f57cf9e6fac6441e20e6ec4193fc8268d679ccbafb9ec0e50781357b3b.exe
Resource
win10v2004-20231215-en
General
-
Target
a9b078f57cf9e6fac6441e20e6ec4193fc8268d679ccbafb9ec0e50781357b3b
-
Size
1.0MB
-
MD5
aeca528d6d90acdb44b8cadf13b8c54f
-
SHA1
81dde1db02a02531c55f86854b386d5153ec209a
-
SHA256
a9b078f57cf9e6fac6441e20e6ec4193fc8268d679ccbafb9ec0e50781357b3b
-
SHA512
06f73f7cf18802a93a51d3c0e19653095e8faff54fe4745de1faaa6ff990c86cf0802627ce4646a240247d6b99134309ed68aa1cba53579424806cac98199ac0
-
SSDEEP
12288:33TiFjF+HKZuZVzeUiiduuqc98H3MlhIkl5Vmo0kfEjzQNuMrllv6:emHDVyJcvhIkl5VmlkfEj0Hy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9b078f57cf9e6fac6441e20e6ec4193fc8268d679ccbafb9ec0e50781357b3b
Files
-
a9b078f57cf9e6fac6441e20e6ec4193fc8268d679ccbafb9ec0e50781357b3b.exe windows:6 windows x86 arch:x86
6e79a08a025106ac68de35b485536b37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FindResourceExW
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
CopyFileA
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
GetExitCodeProcess
InitializeCriticalSectionEx
DeleteCriticalSection
ReadConsoleW
ReadFile
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
HeapQueryInformation
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetCurrentProcess
WaitForSingleObject
HeapSize
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
CloseHandle
RaiseException
GetCurrentDirectoryA
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
VirtualQuery
FreeLibrary
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
HeapValidate
GetSystemInfo
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetCurrentThread
WriteConsoleW
SetConsoleCtrlHandler
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
SetEndOfFile
user32
MessageBoxA
GetClientRect
EndPaint
UnregisterClassA
DrawTextA
DestroyWindow
PostQuitMessage
DefWindowProcA
ExitWindowsEx
BeginPaint
gdi32
SetBkMode
SetBkColor
ExtTextOutA
advapi32
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegGetValueA
shell32
ShellExecuteExA
SHGetFolderPathA
Sections
.text Size: 850KB - Virtual size: 849KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ