Static task
static1
Behavioral task
behavioral1
Sample
1feec349b1c2a30cd8b31455c3e53800.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1feec349b1c2a30cd8b31455c3e53800.exe
Resource
win10v2004-20231215-en
General
-
Target
1feec349b1c2a30cd8b31455c3e53800
-
Size
325KB
-
MD5
1feec349b1c2a30cd8b31455c3e53800
-
SHA1
567165c36e51f018e5fe8198fb074c1999eb83a8
-
SHA256
31d62e1ab3db232f4767538961573821342898f29099ea375cbdb6f8b478ceff
-
SHA512
3514ac395afe0848eaf3a4d30d2b1ec7036167afd3133225ae8291af32cf95b5c25fdd7f453bafabb7f93d71ab59229d99e9ef9f0bf7b77ee6beaf16879cc406
-
SSDEEP
6144:oS2ekECzI92rthD7NHtca9ny1q0e315gpOdzelgQEd1EQkyfRDBUdG9gsJ3:t2ekECzIYy1FeWOdqCd1EQJRBwG9X3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1feec349b1c2a30cd8b31455c3e53800
Files
-
1feec349b1c2a30cd8b31455c3e53800.exe windows:5 windows x86 arch:x86
306b299237837771c95a241c05c3bfaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wldap32
ord46
ord27
ord301
ord33
ord200
ord79
ord35
ord32
ord30
ord26
ord50
ord60
ord143
ord211
ord22
ord41
ws2_32
getsockname
ntohs
ioctlsocket
closesocket
bind
WSACleanup
send
recv
WSAGetLastError
htons
getsockopt
setsockopt
connect
socket
gethostbyname
WSASetLastError
sendto
recvfrom
accept
listen
__WSAFDIsSet
select
WSAStartup
kernel32
EnterCriticalSection
SetEndOfFile
GetLocaleInfoW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetStringTypeW
GetStringTypeA
GetCurrentDirectoryA
GetFullPathNameA
SetStdHandle
FlushFileBuffers
GetModuleHandleA
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
WriteFile
ExitProcess
GetVolumeInformationA
Sleep
CreateThread
SetLastError
FormatMessageA
GetLastError
SleepEx
CloseHandle
DuplicateHandle
GetCurrentProcess
WaitForSingleObject
ReleaseMutex
SetEvent
WaitForMultipleObjects
CreateEventA
CreateMutexA
GetExitCodeThread
TerminateThread
GetTickCount
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
GetProcessHeap
LeaveCriticalSection
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
GetCommandLineA
GetStartupInfoA
HeapReAlloc
ExitThread
GetCurrentThreadId
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
GetCPInfo
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
Sections
.text Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ