Static task
static1
Behavioral task
behavioral1
Sample
0083b07dba712fd09d10ea70c3eb5491.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0083b07dba712fd09d10ea70c3eb5491.exe
Resource
win10v2004-20231215-en
General
-
Target
0083b07dba712fd09d10ea70c3eb5491
-
Size
536KB
-
MD5
0083b07dba712fd09d10ea70c3eb5491
-
SHA1
b18251868a1afba068b4462e452a7ec424f614ab
-
SHA256
2643b5d2aa78a1784f5d59bb71e00283af5bc81f4ff7c14b5d3532bffcf03221
-
SHA512
368de9e2179c3ae7ed12b197ca32500c89c59cb37dd824cedd9115e7dcf1b04c2ff70e296ba81038d1eca0eb68aa5b2029a9196f502cef9c1ddeede3ab066b3f
-
SSDEEP
12288:6MMnMMMMMUQEXhRgxrdXtzGcApWZehcZ4UScVQ2pt:6MMnMMMMMnSh+xfaVpWZScocVQ2pt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0083b07dba712fd09d10ea70c3eb5491
Files
-
0083b07dba712fd09d10ea70c3eb5491.exe windows:4 windows x86 arch:x86
80a5dffbaef1a8cda8e1c387752279d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlAdjustPrivilege
NtWaitForKeyedEvent
RtlInitUnicodeString
msvcrt
memmove
wcschr
free
wcslen
_initterm
_adjust_fdiv
_except_handler3
memset
wcscat
memcmp
malloc
memcpy
_wcsicmp
strlen
wcscpy
wcscmp
wcsncpy
swprintf
kernel32
FreeLibrary
GetCurrentProcessId
GetLastError
VirtualAlloc
CreateEventW
CreateMutexA
DeleteCriticalSection
GetCurrentThreadId
GetTickCount
RegisterWaitForSingleObject
CreateFileW
CreateTimerQueue
DeleteTimerQueueTimer
DisableThreadLibraryCalls
HeapFree
CreateTimerQueueTimer
ReadFile
InterlockedDecrement
HeapAlloc
UnhandledExceptionFilter
HeapCreate
SetLastError
QueueUserWorkItem
ReleaseMutex
InitializeCriticalSection
HeapDestroy
CloseHandle
BindIoCompletionCallback
GetCurrentProcess
UnregisterWaitEx
Sleep
InterlockedExchange
LoadLibraryW
TerminateProcess
CreateMutexW
LeaveCriticalSection
DeviceIoControl
WideCharToMultiByte
SetUnhandledExceptionFilter
GetComputerNameExW
HeapReAlloc
ChangeTimerQueueTimer
QueryPerformanceCounter
InterlockedIncrement
WaitForSingleObject
UnregisterWait
GetSystemTimeAsFileTime
GetProcAddress
MultiByteToWideChar
EnterCriticalSection
ExpandEnvironmentStringsW
SetEvent
ws2_32
freeaddrinfo
WSALookupServiceEnd
WSAStringToAddressA
WSAAddressToStringA
WSASocketW
WSAIoctl
WSASendTo
WSALookupServiceBeginW
getaddrinfo
getnameinfo
WSALookupServiceNextW
WSARecvFrom
WSAEventSelect
WSAAddressToStringW
dnsapi
DnsReplaceRecordSetW
advapi32
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
SetServiceStatus
RegOpenKeyExW
RegisterServiceCtrlHandlerW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegCloseKey
ole32
CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance
mswsock
GetAcceptExSockaddrs
AcceptEx
iphlpapi
GetAdaptersInfo
NotifyRouteChange
NotifyAddrChange
GetAdaptersAddresses
ddraw
DirectDrawCreate
Sections
.text Size: 4KB - Virtual size: 888B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 472KB - Virtual size: 470KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ