Static task
static1
Behavioral task
behavioral1
Sample
fc496dfb5c85149f83112f3c5775e31d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fc496dfb5c85149f83112f3c5775e31d.exe
Resource
win10v2004-20231215-en
General
-
Target
fc496dfb5c85149f83112f3c5775e31d
-
Size
1.0MB
-
MD5
fc496dfb5c85149f83112f3c5775e31d
-
SHA1
833c4a9e9c6d72f4521e0aa765481981a9187dac
-
SHA256
cab3b60abd1176019eeb238342dbec6f90e31a6dec131452e8d3654c1cd76d8f
-
SHA512
c043179228adb9529a61ff9a6874d14aa73dcdd4da2d2ed676d29acc66fc083fc353676f5693f8547cabb8dca4f040f81b6cf9018fe2f4fcaef6cce06b1631d8
-
SSDEEP
24576:gKGoaTcFWbyscquYS27J7HX2d0XXlkajnoV+:gKGpcQyscqoOnlkaX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc496dfb5c85149f83112f3c5775e31d
Files
-
fc496dfb5c85149f83112f3c5775e31d.exe windows:4 windows x86 arch:x86
ef76cbb2da84af32cc348624357dbb92
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
LoadLibraryA
GetVersion
GetVersionExA
GetFileSize
LocalFree
LocalAlloc
lstrcpyA
lstrcatA
CreateEventA
GetStartupInfoA
GlobalFree
GlobalAlloc
gdi32
GetBkColor
DeleteObject
CreateFontIndirectA
GetTextColor
GetDeviceCaps
GetTextExtentPoint32A
SetROP2
GetObjectA
ExtTextOutA
PatBlt
SelectObject
MoveToEx
SetPixel
GetPixel
BitBlt
LineTo
msvcrt
rand
exit
memmove
_c_exit
_adjust_fdiv
_acmdln
user32
GetWindowRect
BeginPaint
ScreenToClient
SetFocus
DispatchMessageA
EndDialog
SetWindowTextA
GetFocus
DialogBoxParamA
GetSysColor
MessageBoxA
CreateWindowExA
PostQuitMessage
GetClientRect
ShowWindow
DefWindowProcA
DestroyWindow
Sections
.text Size: 1024B - Virtual size: 943B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 478B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1018KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ