Static task
static1
Behavioral task
behavioral1
Sample
03672afa150e953d2e9f252f27065bf8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
03672afa150e953d2e9f252f27065bf8.exe
Resource
win10v2004-20231215-en
General
-
Target
03672afa150e953d2e9f252f27065bf8
-
Size
27KB
-
MD5
03672afa150e953d2e9f252f27065bf8
-
SHA1
3da0496a653ae1bd930950b441e8a63da0fb062c
-
SHA256
045f5d05b2ad26046ec0a3779f596f5dccce836d8727979ef1d3a798319cb08c
-
SHA512
43a806e372513a5c10ef166e25270925983c9c570821c5df05098f781e531e08155ecfcf5d72c88dbd3115d8d73985ab0fcb89589a093b2b5c21b498c409d225
-
SSDEEP
768:9dxfq9LidS9tj9t7GK+cZahN/ez+pq7GM:5qF0RpVM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03672afa150e953d2e9f252f27065bf8
Files
-
03672afa150e953d2e9f252f27065bf8.exe windows:4 windows x86 arch:x86
e72b60a5cceeebbedc74856484e7f05f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
CreateThread
GetModuleFileNameA
Sleep
GetTempPathA
lstrcatA
CopyFileA
GetCurrentProcess
WinExec
DeleteFileA
OutputDebugStringA
user32
GetWindowLongA
FindWindowA
ShowWindow
urlmon
URLDownloadToCacheFileA
URLDownloadToFileA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
wininet
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
msvcp60
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ifstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
shell32
ShellExecuteA
msvcrt
strlen
_onexit
__dllonexit
fseek
ftell
strcmp
fopen
fwrite
fclose
fread
atoi
_EH_prolog
__CxxFrameHandler
strrchr
memcpy
memset
malloc
strchr
strcpy
sprintf
strcat
_stricmp
Sections
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE