Static task
static1
Behavioral task
behavioral1
Sample
082db7797ce9826e6a26da77307a41e4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
082db7797ce9826e6a26da77307a41e4.exe
Resource
win10v2004-20231215-en
General
-
Target
082db7797ce9826e6a26da77307a41e4
-
Size
159KB
-
MD5
082db7797ce9826e6a26da77307a41e4
-
SHA1
3023bb1d594f58b8fe59435f8dbb28ba93aa1049
-
SHA256
1e7d26c96e8b0ad308b756ba1cac1bb65326f1f1a5038343d163cd89aa788d34
-
SHA512
7914e9d717a62a9e43fbef08c501fddbb37ca5db7206afbf6ab67ba2076c50f19f7c6a04f4f6f1b7894b5da542f61ff3786b721c6dd2db1ae1ce759902f5784e
-
SSDEEP
3072:UuPZtAr6Ta+CRCqtggDFb6bejqS4RTGaCr8m7GxH2zDk/n4Fg0f0:HxWr6Vyx9MbKuTGayoP4K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 082db7797ce9826e6a26da77307a41e4
Files
-
082db7797ce9826e6a26da77307a41e4.exe windows:1 windows x86 arch:x86
68a20324131b1b0778d30e52920f0b70
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteW
kernel32
CreateFileA
GetCurrentProcess
lstrlenA
DeleteFileW
WriteFile
CreateFileW
VirtualFree
GenerateConsoleCtrlEvent
OpenProcess
GetModuleFileNameA
GetSystemDirectoryW
DeleteFileA
GetFileSizeEx
BeginUpdateResourceA
NlsGetCacheUpdateCount
GetSystemDirectoryA
ReadFile
lstrcatA
GetLocaleInfoA
GetWindowsDirectoryA
InterlockedExchange
GetLastError
GetModuleHandleA
FindClose
ReadConsoleOutputA
lstrcpyW
GetSystemDefaultLCID
Sleep
SetTermsrvAppInstallMode
CompareFileTime
DisableThreadLibraryCalls
FindNextFileA
GetProcAddress
SetComputerNameA
ReadDirectoryChangesW
lstrcatW
VirtualAlloc
LeaveCriticalSection
GetCommandLineW
_lopen
FindFirstFileA
RemoveLocalAlternateComputerNameW
HeapCreate
DuplicateHandle
GetNextVDMCommand
EscapeCommFunction
QueryDepthSList
InitializeCriticalSection
lstrcpyA
GetTickCount
CloseHandle
GetStartupInfoW
CreateSemaphoreA
EnterCriticalSection
CopyFileA
advapi32
AdjustTokenPrivileges
InstallApplication
CryptDestroyHash
CloseServiceHandle
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
EnumServicesStatusA
RegQueryValueA
CreateTraceInstanceId
RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
BackupEventLogW
ntdll
isspace
RtlFreeUnicodeString
ZwLoadDriver
strstr
vsprintf
memset
strncmp
strlen
NtQueryObject
memcpy
isdigit
sprintf
_chkstk
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
RtlInitAnsiString
tolower
wcsstr
psapi
EnumProcesses
GetProcessImageFileNameA
ws2_32
closesocket
__WSAFDIsSet
connect
WSAAsyncSelect
recv
WSAStartup
send
htonl
WSASend
socket
getaddrinfo
htons
htons
setsockopt
select
gethostbyname
ole32
CoCreateGuid
user32
CharLowerW
ValidateRgn
ExitWindowsEx
Sections
.data Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 407B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ