Static task
static1
Behavioral task
behavioral1
Sample
033aaddaa9d822675262848adbd6c630.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
033aaddaa9d822675262848adbd6c630.exe
Resource
win10v2004-20231215-en
General
-
Target
033aaddaa9d822675262848adbd6c630
-
Size
562KB
-
MD5
033aaddaa9d822675262848adbd6c630
-
SHA1
63c493dda0a37ed639866c564e8fbbe21c71b041
-
SHA256
9c08f47b0d72dd54b5a4c4871a8faf7ffe06d542af568d66bf6937569feccc88
-
SHA512
5a27c394f0c892dc11f2716074331ed991841acd42986f2cc2c10e804d5fa4a231c3cf1b170e2f6bbb16fdfe8442660e185b68c41507d903e309da38b3d1d562
-
SSDEEP
12288:+XySNYhrKEApxpuNLkmS/ctQRWxSkglSdAB3P:+540xU4YeU2B3P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 033aaddaa9d822675262848adbd6c630
Files
-
033aaddaa9d822675262848adbd6c630.exe windows:4 windows x86 arch:x86
0deee67eb770945542ffe4cf2357bf57
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapReAlloc
HeapAlloc
HeapFree
VirtualAlloc
LocalCompact
LocalHandle
WaitNamedPipeA
DebugBreak
SetThreadContext
CreateNamedPipeA
FindCloseChangeNotification
GetThreadTimes
ReadConsoleOutputW
VirtualFree
GetUserDefaultLCID
GlobalUnlock
GetSystemDefaultLangID
FindFirstFileW
GetMailslotInfo
SetEndOfFile
WaitForSingleObject
GetStartupInfoW
HeapValidate
SetFilePointer
GlobalFindAtomW
SetFileAttributesW
MoveFileW
FreeResource
LeaveCriticalSection
CreateProcessW
GetStringTypeExW
GetComputerNameW
SearchPathW
GetFullPathNameW
GlobalReAlloc
GetConsoleTitleA
GetTimeZoneInformation
GlobalHandle
GetFullPathNameA
SetLocaleInfoW
GetFileInformationByHandle
VirtualProtect
GetPrivateProfileSectionA
FormatMessageA
OpenWaitableTimerW
SystemTimeToFileTime
GetPrivateProfileIntW
Sleep
GetTempFileNameA
RtlZeroMemory
TerminateThread
lstrcmp
ContinueDebugEvent
GetLogicalDriveStringsA
CreateToolhelp32Snapshot
WriteFile
GetShortPathNameW
GetAtomNameA
GetConsoleOutputCP
TlsAlloc
GetExitCodeThread
DebugActiveProcess
Module32Next
GetProcessTimes
LocalAlloc
InitializeCriticalSection
GetComputerNameA
IsValidCodePage
GetStringTypeExA
GetWindowsDirectoryW
WritePrivateProfileStructW
CreateWaitableTimerA
CommConfigDialogA
CreateNamedPipeW
InterlockedExchangeAdd
GetLongPathNameA
FindAtomA
CopyFileExA
GetHandleInformation
CreateMutexA
GetPrivateProfileStringA
GetACP
ConvertDefaultLocale
BeginUpdateResourceW
GetFileSize
FindResourceExW
ReadConsoleW
DeviceIoControl
lstrcpyn
GetLocaleInfoA
GetVersionExA
GetProcessAffinityMask
GlobalFindAtomA
FindResourceExA
lstrcatA
GetTempPathA
CreateMailslotA
VirtualProtectEx
GetNumberOfConsoleInputEvents
GetProfileIntW
lstrcatW
DefineDosDeviceA
ReadConsoleOutputCharacterW
GetProcessHeaps
FillConsoleOutputCharacterW
GetFileTime
CreateSemaphoreW
SetEnvironmentVariableA
ReadConsoleInputA
GlobalCompact
GlobalDeleteAtom
GlobalSize
VirtualUnlock
CreateDirectoryExA
SetComputerNameA
BeginUpdateResourceA
GetProfileIntA
lstrcpy
GetPrivateProfileStructW
IsValidLocale
GetModuleFileNameW
SetFileTime
GetProcessHeap
CreateFileMappingA
WinExec
GetStringTypeW
EnumDateFormatsExW
wsock32
getservbyname
WSACancelBlockingCall
WSAAsyncGetServByName
gethostname
gethostbyname
setsockopt
WSAAsyncGetHostByAddr
getsockopt
WEP
ord1105
shutdown
getpeername
ord1104
ord1117
ord1102
WSASetLastError
recvfrom
ord1000
select
ord1118
WSAAsyncSelect
listen
ord1130
ord1111
WSAAsyncGetServByPort
ord1109
getservbyport
WSACancelAsyncRequest
getsockname
ord1140
WSACleanup
WSAAsyncGetProtoByNumber
ord1115
socket
ord1108
connect
send
ord1100
ord1116
getprotobyname
htons
ord1119
WSAUnhookBlockingHook
ord1141
closesocket
inet_addr
sendto
WSAAsyncGetHostByName
recv
ord1112
__WSAFDIsSet
ord1101
inet_ntoa
Sections
.text Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 302KB - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE