Static task
static1
Behavioral task
behavioral1
Sample
1e9864fd43640d9d807f2fb54233fa59.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1e9864fd43640d9d807f2fb54233fa59.exe
Resource
win10v2004-20231215-en
General
-
Target
1e9864fd43640d9d807f2fb54233fa59
-
Size
74KB
-
MD5
1e9864fd43640d9d807f2fb54233fa59
-
SHA1
b147eab6ea5c2c3ad0089f9470fa6343faa047f7
-
SHA256
d4f201fd04e4de3b209158f55d32c938f9cea590f8b03f1977853fae0068c452
-
SHA512
f71a9b72afb8d41bc7b7b365bfb37cc06419199d51a86f727584b8039d594e33f543aec3e41e8e5c608163c35e04b4984b3eddf1f9902548a3366d01d7a3b465
-
SSDEEP
1536:7Leuyet/RPRkSxTThVmAmIYQj7WwFGyFr:7Lx79RPRkSx/hVYHSyUtr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e9864fd43640d9d807f2fb54233fa59
Files
-
1e9864fd43640d9d807f2fb54233fa59.exe windows:4 windows x86 arch:x86
23263a4af34437b279880b76200d56df
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
libcrypto-8
ERR_print_errors_fp
kernel32
CloseHandle
CopyFileA
CreatePipe
CreateProcessA
CreateThread
DisconnectNamedPipe
DuplicateHandle
ExitProcess
ExitThread
FreeConsole
GetCurrentProcess
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
PeekNamedPipe
ReadFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
WaitForMultipleObjects
WaitForSingleObject
WriteFile
msvcrt
_close
_dup
_itoa
_kbhit
_open
_read
_strcmpi
_strnicmp
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_iob
_isatty
_onexit
_setjmp
_setmode
_sleep
atexit
atoi
exit
fflush
fgets
fopen
fprintf
fputc
free
fwrite
getenv
gets
longjmp
malloc
memcpy
memset
printf
puts
rand
signal
sprintf
srand
strcat
strchr
strcpy
strlen
strncat
strncmp
strncpy
time
libssl-8
SSL_CTX_free
SSL_CTX_new
SSL_connect
SSL_free
SSL_library_init
SSL_load_error_strings
SSL_new
SSL_read
SSL_set_fd
SSL_shutdown
SSL_write
SSLv23_method
wsock32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 64B
IMAGE_SCN_MEM_DISCARDABLE
/19 Size: 512B - Virtual size: 156B
IMAGE_SCN_MEM_DISCARDABLE
/35 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_DISCARDABLE
/47 Size: 1024B - Virtual size: 734B
IMAGE_SCN_MEM_DISCARDABLE
/61 Size: 1024B - Virtual size: 531B
IMAGE_SCN_MEM_DISCARDABLE
/73 Size: 512B - Virtual size: 172B
IMAGE_SCN_MEM_DISCARDABLE
/86 Size: 512B - Virtual size: 16B
IMAGE_SCN_MEM_DISCARDABLE
/97 Size: 1024B - Virtual size: 548B
IMAGE_SCN_MEM_DISCARDABLE
/108 Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_DISCARDABLE