Static task
static1
Behavioral task
behavioral1
Sample
0474730f09fc4c1ef8dfdba4746c36b1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0474730f09fc4c1ef8dfdba4746c36b1.exe
Resource
win10v2004-20231215-en
General
-
Target
0474730f09fc4c1ef8dfdba4746c36b1
-
Size
21KB
-
MD5
0474730f09fc4c1ef8dfdba4746c36b1
-
SHA1
deebf55324916a690dd97d1f894f192ec63807ab
-
SHA256
ef8d023f259acb7c47e08d069ce4a8ec9792c75eb066e8f52eff6e53198f8f6a
-
SHA512
990702ba1640de02e5e0f3ff4dc001eb32dacecbf5cb96de6fb8cc071108a417baa9526ca7a777eb46de15bc7c5b23b2dec903a1f15b94e96d805384d33980e4
-
SSDEEP
384:waxDERhUSE3QfdCJPK1q6SU3H2497F9RI5IZ9xb:w2yhuR+q6SUXxt7RI5I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0474730f09fc4c1ef8dfdba4746c36b1
Files
-
0474730f09fc4c1ef8dfdba4746c36b1.exe windows:4 windows x86 arch:x86
fb89814db0a6ef18c2a5b5d8c0a8f388
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
urlmon
URLDownloadToCacheFileA
msvcrt
_onexit
__dllonexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_strdup
malloc
strtok
realloc
??2@YAPAXI@Z
strncpy
??3@YAXPAX@Z
strchr
srand
rand
free
_vsnprintf
_beginthread
strstr
_snprintf
??1type_info@@UAE@XZ
_CxxThrowException
wcslen
fopen
fprintf
fclose
calloc
_endthread
_except_handler3
kernel32
WideCharToMultiByte
LocalFree
GetFileAttributesA
GetVersionExA
GetCurrentProcess
GetProcAddress
FreeLibrary
MoveFileExA
TerminateThread
GetTickCount
lstrlenA
SetErrorMode
DeleteFileA
CreateMutexA
GetLastError
GetSystemDirectoryA
GetShortPathNameA
GetCurrentProcessId
ReleaseMutex
GetLogicalDriveStringsA
GetDriveTypeA
CopyFileA
SetFileAttributesA
GetModuleHandleA
GetModuleFileNameA
Sleep
ExitProcess
LoadLibraryA
user32
ShowWindow
BlockInput
SendMessageA
FindWindowExA
ws2_32
gethostbyname
inet_addr
recv
WSAGetLastError
socket
htons
connect
ioctlsocket
WSAStartup
send
closesocket
WSACleanup
shell32
ShellExecuteA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
ntdll
ZwSystemDebugControl
NtQuerySystemInformation
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantClear
VariantInit
dnsapi
DnsQuery_A
DnsRecordListFree
Sections
Size: 13KB - Virtual size: 12KB
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 2KB
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_MEM_WRITE
Size: 257B - Virtual size: 257B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE