Static task
static1
Behavioral task
behavioral1
Sample
fee1d97122e17fba9cf26b4d72270865.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fee1d97122e17fba9cf26b4d72270865.exe
Resource
win10v2004-20231222-en
General
-
Target
fee1d97122e17fba9cf26b4d72270865
-
Size
68KB
-
MD5
fee1d97122e17fba9cf26b4d72270865
-
SHA1
aa122e8b12a3684a0f8940479584125ae3d0e02b
-
SHA256
bd20e2f613f397c8f106fee15431551a08b4e186bb530d4da99c09985b81e8a0
-
SHA512
e737d2f2069cefa7b3c01cff86b4b67d5535d1c39b0da3aa926c90ca405eea4df9bd7dfc1cee24d470dd8435fe369d07c0d5e46723372a1f888a3c7b1ba69d60
-
SSDEEP
1536:+fRLE9BW5GNsC6E8fq0Cy/IPtBtZr2/e6aAqQ+3F3XbwpGEe7lg:3S5Yn8fSv2/yAqQwXMkEe76
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fee1d97122e17fba9cf26b4d72270865
Files
-
fee1d97122e17fba9cf26b4d72270865.exe windows:4 windows x86 arch:x86
537365fb4ae33e23622862e9424ad117
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
CreateProcessA
DuplicateHandle
GetCurrentProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
GetComputerNameA
WriteFile
GetTempPathA
GetModuleHandleA
GetFileSize
GetModuleFileNameA
CopyFileA
DeleteFileA
SetFileAttributesA
GetCurrentThread
ExitProcess
GetStartupInfoA
GetCommandLineA
SetFileTime
GetFileTime
CreateRemoteThread
SetLastError
GetCurrentProcessId
VirtualFree
GetProcAddress
CloseHandle
WaitForSingleObject
GetWindowsDirectoryA
CreateFileA
SetFilePointer
ReadFile
lstrcpyA
GetSystemDirectoryA
CreateThread
VirtualAlloc
GetPriorityClass
ResumeThread
user32
GetWindowThreadProcessId
FindWindowA
wsprintfA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA
OpenProcessToken
shlwapi
SHDeleteKeyA
msvcrt
??2@YAPAXI@Z
__CxxFrameHandler
_EH_prolog
free
malloc
strncpy
strchr
atoi
??3@YAXPAX@Z
_strnicmp
_stricmp
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE