Static task
static1
Behavioral task
behavioral1
Sample
095d4850b6f85c3756316f9e47a83aab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
095d4850b6f85c3756316f9e47a83aab.exe
Resource
win10v2004-20231222-en
General
-
Target
095d4850b6f85c3756316f9e47a83aab
-
Size
164KB
-
MD5
095d4850b6f85c3756316f9e47a83aab
-
SHA1
1c61c489af66b963ea5028550e64b5570be7154e
-
SHA256
16bc44888b40caab23e361b6dfaf96a6a0b7bb1901f3a8ca46a485d2df7b9cbb
-
SHA512
783718a8bfb92d29b4a393749ddb13a4cc1788a9f83d612ed113caa973427661050590921639142d5bc116486ab9d0528a5155dafd7912c3f17e60f99f00a182
-
SSDEEP
3072:Un7GAn043rxnWrauIG2owqPcLjE027drOzKlG:mn0WFnWrauIGW2hyV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 095d4850b6f85c3756316f9e47a83aab
Files
-
095d4850b6f85c3756316f9e47a83aab.exe windows:4 windows x86 arch:x86
4896900c9f108852d5eb13b39f2143fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
Sleep
GetLastError
GetCommandLineW
LocalFree
LocalAlloc
lstrlenW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrcmpW
lstrcmpiW
lstrcpyW
InterlockedIncrement
CreateProcessA
GetModuleFileNameA
InterlockedDecrement
GetVolumeInformationA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryA
HeapReAlloc
WaitForSingleObject
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
TerminateThread
CreateFileA
ReadFile
PeekNamedPipe
CloseHandle
ExitProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStdHandle
WriteFile
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetProcessHeap
HeapAlloc
lstrcpyA
lstrcatA
lstrlenA
VirtualAlloc
HeapFree
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetVersionExA
GetCommandLineA
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
winmm
timeGetTime
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
gethostname
user32
SetTimer
KillTimer
GetWindowLongA
wsprintfA
GetActiveWindow
PostQuitMessage
ReleaseDC
FillRect
GetDC
SetRect
ShowWindow
SetWindowLongA
UnregisterClassW
CreateWindowExW
RegisterClassW
GetMessageA
TranslateMessage
DispatchMessageA
GetClientRect
DefWindowProcA
wsprintfW
advapi32
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
ole32
CoCreateInstance
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
oleaut32
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen
VariantInit
gdiplus
GdipCloneImage
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
gdi32
DeleteObject
GetStockObject
SelectObject
CreateCompatibleBitmap
DeleteDC
CreateCompatibleDC
wininet
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
HttpQueryInfoA
shell32
CommandLineToArgvW
Sections
.text Size: 128KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE