Static task
static1
Behavioral task
behavioral1
Sample
ff7e5c9f8f1b8881d42646bb18a12544.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ff7e5c9f8f1b8881d42646bb18a12544.exe
Resource
win10v2004-20231222-en
General
-
Target
ff7e5c9f8f1b8881d42646bb18a12544
-
Size
156KB
-
MD5
ff7e5c9f8f1b8881d42646bb18a12544
-
SHA1
76f2bfba5044f4fbec234856f2f6893d80d629a3
-
SHA256
e0c17c06262c581dc2b367539e9bce86c029d022b2da1854e38b27ada5d74c03
-
SHA512
24e0420e291459bca9d1dad961a47ca41bacc9fdb72e9060e839ab9b95b407a7286ed31203e26902edd1ee887a506d71cc93cfe189fcc203ea63541f49987c79
-
SSDEEP
3072:Q9EFvCrYRVRnb038D40F2Cov7kMLdU85Mtu:Q9ovCrYhI38D87k8fD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff7e5c9f8f1b8881d42646bb18a12544
Files
-
ff7e5c9f8f1b8881d42646bb18a12544.exe windows:5 windows x86 arch:x86
078a0f381f26c36fc8bb842a95742a13
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
IsBadStringPtrW
SetFileShortNameA
ReplaceFileW
RegisterConsoleOS2
GetTapeStatus
IsValidCodePage
GetThreadLocale
IsDebuggerPresent
TryEnterCriticalSection
GetModuleHandleA
AddAtomA
SetHandleInformation
GetConsoleInputExeNameW
GetUserDefaultLCID
EnumDateFormatsExA
LocalFlags
SetComPlusPackageInstallStatus
GetSystemDirectoryW
GetSystemDefaultLCID
GlobalMemoryStatus
EnterCriticalSection
GetACP
LoadLibraryA
SetTapePosition
WriteConsoleOutputA
FillConsoleOutputCharacterW
RegisterConsoleVDM
IsValidLocale
GlobalGetAtomNameA
UnregisterWait
VirtualAlloc
OpenEventA
LeaveCriticalSection
BaseCheckAppcompatCache
CreateRemoteThread
CreateDirectoryExA
CreateActCtxA
FindCloseChangeNotification
WriteFileGather
GetBinaryTypeA
netapi32
I_NetServerPasswordSet
NetReplExportDirLock
I_BrowserSetNetlogonState
NetDfsSetInfo
I_NetServerAuthenticate3
I_NetLogonControl
RxNetAccessAdd
NetDfsAddStdRootForced
DsAddressToSiteNamesExW
NlBindingSetAuthInfo
DsAddressToSiteNamesA
NetWkstaTransportDel
NetpwNameCanonicalize
RxNetAccessGetInfo
NetpwPathCanonicalize
NetRemoteComputerSupports
NetpIsRemote
NetWkstaTransportAdd
DsRoleGetDcOperationProgress
NetServerEnum
NetpMergeFtinfo
I_NetServerGetTrustInfo
NetApiBufferFree
NetServerDiskEnum
NetUserModalsSet
NetReplImportDirEnum
NetGetJoinInformation
NetDfsGetInfo
NetDfsRemove
I_NetDfsIsThisADomainName
I_NetServerPasswordGet
DsGetDcSiteCoverageA
NetAuditClear
DsGetDcNameWithAccountA
RxNetAccessDel
DsGetDcCloseW
NetUseAdd
lz32
LZInit
LZClose
CopyLZFile
LZCloseFile
LZStart
LZCreateFileW
LZSeek
LZOpenFileW
LZCopy
GetExpandedNameA
LZDone
LZOpenFileA
LZRead
msvcp60
?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAF@Z
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_7length_error@std@@6B@
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Nanv@?$_Ctr@M@std@@SAMM@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?exp@std@@YA?AV?$complex@O@1@ABV21@@Z
??Kstd@@YA?AV?$complex@M@0@ABMABV10@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
??8std@@YA_NABV?$complex@N@0@0@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??4?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Makpat@?$_Mpunct@G@std@@AAEXAAUpattern@money_base@2@DDD@Z
_Stold
??4?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?grouping@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?eof@?$char_traits@D@std@@SAHXZ
??Kstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1ostrstream@std@@UAE@XZ
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ
??Hstd@@YA?AV?$complex@O@0@ABOABV10@@Z
esent
JetRenameTable
JetGotoBookmark
JetResetSessionContext
JetSetCurrentIndex2
JetOpenTempTable2
JetAttachDatabaseWithStreaming
JetBackupInstance
JetUpgradeDatabase
JetEndSession
JetCreateIndex2
JetDBUtilities
JetGetInstanceInfo
JetSetLS
JetDupCursor
JetOSSnapshotThaw
JetIndexRecordCount
JetUnregisterCallback
JetRestore
JetGetLogInfoInstance
JetBeginTransaction
JetBeginExternalBackup
JetCloseFile
JetBeginExternalBackupInstance
JetGetSystemParameter
JetUpdate
JetCloseTable
JetGetLS
JetRetrieveColumn@32
JetIntersectIndexes
JetDeleteTable
JetRetrieveKey
JetCompact
msvcrt
__set_app_type
exit
__getmainargs
__p__commode
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ