Static task
static1
Behavioral task
behavioral1
Sample
20648ccd413afb534f000a553748e690.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
20648ccd413afb534f000a553748e690.exe
Resource
win10v2004-20231222-en
General
-
Target
20648ccd413afb534f000a553748e690
-
Size
41KB
-
MD5
20648ccd413afb534f000a553748e690
-
SHA1
8eb97fa62598bd2834f7882e7ef560d1f2cd5983
-
SHA256
9e566ccc90548c6f09634eab7fe7cacee713f49b3c7c09e812e8a6a9c1944a19
-
SHA512
eac25347ec7ec54368bcf768fd3b2aeba1719cdd2c22d12038e84f367cb487d866a8957aa61cd2e7b31d0dd3bb6306f93fb9b3d4e5769b3c97173ee1605f2eb1
-
SSDEEP
768:5Z0lg8+UAq4OwSRNFdv7QuhQ0KTM/0V6Wt7JyVkW0CzCABly1xp9Whwurh69pCLz:5Z0kv1z4h1rd03NKmdjw9UH6nnqFO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20648ccd413afb534f000a553748e690
Files
-
20648ccd413afb534f000a553748e690.exe windows:4 windows x86 arch:x86
ccbc68dbeff0f6e34c30d081f79f26b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strcpy
strlen
fopen
fprintf
fclose
exit
toupper
_ftol
ceil
_endthread
strcmp
strncpy
_beginthread
atoi
??1type_info@@UAE@XZ
_CxxThrowException
strstr
srand
rand
_snprintf
memset
_vsnprintf
strncat
kernel32
LocalFree
GetSystemTime
GetFileSize
SetFilePointer
ReadFile
FreeLibrary
LoadLibraryA
GetProcAddress
VirtualAllocEx
CreateRemoteThread
DeleteFileA
GlobalAlloc
GlobalLock
GlobalUnlock
WinExec
GetComputerNameA
GetLocaleInfoA
GetTickCount
TerminateThread
Sleep
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
ExitProcess
GetLastError
SetFileAttributesA
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
GetTempPathA
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersionExA
GetFileAttributesA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
MoveFileExA
GetEnvironmentVariableA
GetShortPathNameA
lstrlenA
CloseHandle
WriteFile
CreateFileA
CreateDirectoryA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
WriteProcessMemory
user32
MessageBoxA
SetClipboardData
CloseClipboard
OpenClipboard
FindWindowA
GetWindowThreadProcessId
EmptyClipboard
keybd_event
SetForegroundWindow
SetFocus
ShowWindow
VkKeyScanA
BlockInput
ws2_32
connect
send
htons
socket
recv
closesocket
WSAStartup
gethostbyname
inet_addr
wininet
InternetOpenUrlA
InternetOpenA
InternetReadFile
urlmon
URLDownloadToFileA
shell32
ShellExecuteExA
SHChangeNotify
ShellExecuteA
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
ntdll
NtQuerySystemInformation
ZwSystemDebugControl
oleaut32
VariantClear
SysAllocString
VariantInit
ole32
CoUninitialize
CoInitialize
CoCreateInstance
shlwapi
SHDeleteKeyA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE