DotNetRuntimeDebugHeader
Static task
static1
Behavioral task
behavioral1
Sample
37e075649c951e9b9362d8487ded6628731409a659f49a1ffd4e21b3900b2aeb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37e075649c951e9b9362d8487ded6628731409a659f49a1ffd4e21b3900b2aeb.exe
Resource
win10v2004-20231215-en
General
-
Target
37e075649c951e9b9362d8487ded6628731409a659f49a1ffd4e21b3900b2aeb
-
Size
1.2MB
-
MD5
b9fa71213a3a746a2fde31d019b32096
-
SHA1
7b86ef156858e4e51dc1368f9df8d9ab52c2b890
-
SHA256
37e075649c951e9b9362d8487ded6628731409a659f49a1ffd4e21b3900b2aeb
-
SHA512
ba23a14606f644b5d56b055c8b42a47a32141d5f8c26d00fc72f29adfc1b63e96310421e378ea740b547e71fd9474553838d6c527b8228111818ae70697b7ec9
-
SSDEEP
24576:KouyJGixHUhorJnsgbB1U3+6fhDTTBAZg94EHv1I+jwx3qCeX:nuyJdxHUhorPYc01Sa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37e075649c951e9b9362d8487ded6628731409a659f49a1ffd4e21b3900b2aeb
Files
-
37e075649c951e9b9362d8487ded6628731409a659f49a1ffd4e21b3900b2aeb.exe windows:6 windows x64 arch:x64
2bee38bd279e44bf1aa016ac1ea0f2e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
bcrypt
BCryptGenRandom
kernel32
FreeLibrary
TlsFree
GetStdHandle
RaiseFailFastException
GetTickCount64
GetCurrentProcess
GetCurrentThread
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
GetLastError
QueryPerformanceFrequency
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
SetLastError
DuplicateHandle
GetThreadPriority
WriteFile
GetCurrentProcessorNumberEx
CloseHandle
SetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
GetCPInfoExW
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
WriteConsoleW
GetConsoleCP
MultiByteToWideChar
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
TerminateProcess
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
ResetEvent
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId
ole32
CoUninitialize
CoWaitForMultipleHandles
CoGetApartmentType
CoInitializeEx
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
_stricmp
wcsncmp
strcpy_s
strcmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_set_app_type
abort
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
terminate
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
calloc
free
_callnewh
malloc
_set_new_mode
Exports
Exports
Sections
.text Size: 405KB - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
hydrated Size: - Virtual size: 194KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 387KB - Virtual size: 387KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ