Static task
static1
Behavioral task
behavioral1
Sample
ff4d3996399171abcb75304a8044dcc7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ff4d3996399171abcb75304a8044dcc7.exe
Resource
win10v2004-20231215-en
General
-
Target
ff4d3996399171abcb75304a8044dcc7
-
Size
70KB
-
MD5
ff4d3996399171abcb75304a8044dcc7
-
SHA1
59346fd6531a08c6dd79dbc25bcade95dabefdbd
-
SHA256
e66a954b5d2054fec4c7d6e4332ccf2f2baa413c7eaa8687b63983072383ba6f
-
SHA512
7813755f36ce493c39067829fe3569682bdb31e3b4caddd5c1248bdfc7ae4934a5be8722de961afc6c6e8e24d1a88eff88dedea8b9b8b22b73558844e83e4466
-
SSDEEP
1536:br+SCGkjsUXKhhpZXF6XUF7mJvz1Wd5OI7kCUmZM/r7:bCiW4pZXF6EAhQ2ZmGj7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff4d3996399171abcb75304a8044dcc7
Files
-
ff4d3996399171abcb75304a8044dcc7.exe windows:4 windows x86 arch:x86
1b1f8bafc7e8e1dafb58725e16275805
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetVersionExA
OpenFile
FreeLibrary
GetProcAddress
LoadLibraryA
_lcreat
WinExec
_lopen
GetModuleFileNameA
GetModuleHandleA
GetCommandLineA
SetErrorMode
ExitProcess
_lwrite
GetLastError
lstrcatA
GlobalLock
FormatMessageA
LocalFree
lstrcpyA
GetTempPathA
GetWindowsDirectoryA
GetTempFileNameA
MulDiv
lstrlenA
_lread
_llseek
GlobalUnlock
GlobalFree
GlobalAlloc
_lclose
user32
ExitWindowsEx
wsprintfA
CreateWindowExA
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
MessageBoxA
BeginPaint
DrawTextA
EndPaint
InvalidateRect
PostQuitMessage
DefWindowProcA
GetDC
ReleaseDC
GetClientRect
SendMessageA
gdi32
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
TextOutA
RealizePalette
SelectPalette
CreatePalette
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
PatBlt
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ