Static task
static1
Behavioral task
behavioral1
Sample
fc378bdeff6eddd828869334633ef49a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fc378bdeff6eddd828869334633ef49a.exe
Resource
win10v2004-20231215-en
General
-
Target
fc378bdeff6eddd828869334633ef49a
-
Size
62KB
-
MD5
fc378bdeff6eddd828869334633ef49a
-
SHA1
c865c9b1eef9af90d1fa5e8b4be667e60519b2b8
-
SHA256
80279eaaed195e9fb765b5f1897e0936e313742b90d5a2c49c342d6fd11ea5d5
-
SHA512
882f129684ca337aad7da49dc2d88cb7f953c999607fe190217052e1183c0454e7ac0b2d953691dc2ae41ea43e9ea761a715b9da859af74bdd580e623268bff7
-
SSDEEP
1536:/y8ckMx3PxJTRU+V2vat+V28In3ncKyZYQATnAf:KhkMx3PxxRzzsLI3n0QMf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc378bdeff6eddd828869334633ef49a
Files
-
fc378bdeff6eddd828869334633ef49a.exe windows:6 windows x86 arch:x86
2e425f2675b17063ef08e8fa563efa65
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrToIntW
PathSkipRootW
PathFindFileNameW
StrCmpIW
StrStrIW
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
bcrypt
BCryptGenRandom
ntdll
LdrEnumerateLoadedModules
RtlAcquirePebLock
memcpy
_chkstk
ZwSetInformationProcess
memset
ZwQueryInformationProcess
RtlReleasePebLock
kernel32
GetWindowsDirectoryW
CreateThread
GetCommandLineW
GetTempFileNameW
FreeResource
FindResourceW
LoadResource
LoadLibraryExW
MoveFileExW
WriteFile
OpenEventW
SizeofResource
GetFileAttributesW
GetModuleFileNameW
CreateFileW
FlushFileBuffers
GetTempPathW
GetPrivateProfileIntW
MoveFileW
LockResource
lstrcmpiW
GetModuleHandleA
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
ExpandEnvironmentStringsW
GetProcAddress
LoadLibraryA
GetNativeSystemInfo
GetCurrentProcess
CreateDirectoryW
CreateEventW
SetFileTime
TerminateProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetFileTime
OpenProcess
GetTickCount
ExitProcess
CloseHandle
GetLastError
Sleep
WaitForSingleObject
lstrcpyW
lstrcatW
lstrlenW
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GetSystemDirectoryW
GetModuleHandleW
user32
MessageBoxW
wsprintfW
advapi32
GetTokenInformation
CryptAcquireContextW
RegDeleteKeyValueW
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
DuplicateTokenEx
CreateProcessWithTokenW
OpenProcessToken
EnumServicesStatusExW
RevertToSelf
QueryServiceStatusEx
RegDeleteTreeW
ImpersonateLoggedOnUser
CreateWellKnownSid
AdjustTokenPrivileges
CheckTokenMembership
OpenSCManagerW
CloseServiceHandle
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueW
RegQueryInfoKeyW
RegSetValueW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
DuplicateToken
LookupPrivilegeValueW
CryptGenRandom
StartServiceW
OpenServiceW
shell32
CommandLineToArgvW
ShellExecuteExW
SHChangeNotify
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
IIDFromString
CoInitializeSecurity
CoUninitialize
CoCreateGuid
StringFromGUID2
CoGetObject
oleaut32
VariantClear
SysFreeString
SysAllocString
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ