Static task
static1
Behavioral task
behavioral1
Sample
1eb63c75b5f0a5bfdec78be44ed973c4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1eb63c75b5f0a5bfdec78be44ed973c4.exe
Resource
win10v2004-20231215-en
General
-
Target
1eb63c75b5f0a5bfdec78be44ed973c4
-
Size
20KB
-
MD5
1eb63c75b5f0a5bfdec78be44ed973c4
-
SHA1
1693c9289dc3cd61a28e85135ca928828c4bf999
-
SHA256
ada56570ac02d04300efd541f19d882d3bfe586d831c49d00afd693c1584aa4c
-
SHA512
c7e952152abab750ac0b45a01f757d0ba194b0b62c2de6ae3caaa8c8f27293c979d79197d55f61fb2beef95dce198b1eb39524ce960d89ce1e7bf3651882df96
-
SSDEEP
192:K1oM/byqn63FB2OjXGc6zJvcBZb2cobdqszkJbAh9zHJCyQ5dEgP1oyGS:bCZn63COAW2cSW0hGyQ5dR1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1eb63c75b5f0a5bfdec78be44ed973c4
Files
-
1eb63c75b5f0a5bfdec78be44ed973c4.exe windows:4 windows x86 arch:x86
bb54fbd61a94e7d8f24a7e6dba432fe7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
CopyFileA
lstrcpyA
GetModuleFileNameA
GetSystemDirectoryA
CloseHandle
ReadFile
GetFileSize
CreateFileA
WriteFile
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
LoadLibraryA
WriteProcessMemory
VirtualAllocEx
lstrlenW
OpenProcess
MultiByteToWideChar
GetCurrentProcess
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
SetFilePointer
GetProcAddress
GetLastError
GetStartupInfoA
GetModuleHandleA
Sleep
user32
wsprintfA
CharUpperA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
msvcrt
_XcptFilter
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
__CxxFrameHandler
_EH_prolog
strcmp
strcat
strrchr
strlen
_except_handler3
strstr
memcpy
_exit
_controlfp
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE