Static task
static1
Behavioral task
behavioral1
Sample
0bd9e4a9d8a87972fa17258a16366f5b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0bd9e4a9d8a87972fa17258a16366f5b.exe
Resource
win10v2004-20231215-en
General
-
Target
0bd9e4a9d8a87972fa17258a16366f5b
-
Size
629KB
-
MD5
0bd9e4a9d8a87972fa17258a16366f5b
-
SHA1
0fa1ec8336aad90e9ea728a758da3a6dc4654b33
-
SHA256
0199599c24a84386c32b232e078601f85eee3024a61e1e031cb96819552d1728
-
SHA512
0b70d55f5c435b8f95f74af18fb182a2d6b0655cfe3c32bbdb83b428ff1226a3e2d22d8ead8beab2169ddf9e8135ab6a263eea5a9d6be2dfb8dc34a3935dd89a
-
SSDEEP
12288:I9HQn7zpomIWjzyYmDQeUI5G/5CwOXaQo+5D2d:yQnHNiHQ3hTOer
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bd9e4a9d8a87972fa17258a16366f5b
Files
-
0bd9e4a9d8a87972fa17258a16366f5b.exe windows:4 windows x86 arch:x86
b5be950a0844cd2085c2045ad18b9f1f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
TlsFree
GetCommandLineW
GetStartupInfoA
VirtualFree
CompareStringW
GetStringTypeA
Sleep
CompareStringA
GetCurrentThread
FreeEnvironmentStringsW
TlsAlloc
GetLocaleInfoW
LCMapStringA
IsDebuggerPresent
GetStringTypeW
IsValidLocale
GetConsoleOutputCP
HeapDestroy
GetEnvironmentStringsW
GetTimeFormatA
SetHandleCount
GetConsoleTitleW
GetTimeZoneInformation
GetCurrentThreadId
DeleteCriticalSection
HeapReAlloc
QueryPerformanceCounter
GetStdHandle
SetLastError
GetACP
SetEnvironmentVariableA
GetModuleFileNameA
TlsSetValue
IsValidCodePage
CloseHandle
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
FindFirstFileW
WriteFile
ReadFile
GetFileType
GetCurrentProcessId
RtlUnwind
WideCharToMultiByte
GetCPInfo
VirtualAlloc
HeapSize
GetCurrencyFormatW
GetConsoleCP
SetUnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetUserDefaultLCID
VirtualQuery
InterlockedIncrement
TlsGetValue
GetPrivateProfileSectionA
GetModuleHandleA
UnhandledExceptionFilter
GetProcAddress
GetCommandLineA
EnumSystemLocalesA
GetLocaleInfoA
FreeLibrary
InterlockedExchange
GetTickCount
GetModuleHandleW
LCMapStringW
ExpandEnvironmentStringsA
HeapFree
ExitProcess
GetModuleFileNameW
GetOEMCP
GetConsoleMode
SetStdHandle
GetLastError
GetDateFormatA
WriteConsoleA
WriteConsoleW
TerminateProcess
SetConsoleCtrlHandler
LeaveCriticalSection
CreateFileA
SetFilePointer
InterlockedDecrement
GetStartupInfoW
LoadLibraryA
MultiByteToWideChar
OpenMutexA
EnterCriticalSection
GetDriveTypeA
HeapAlloc
CreateMutexA
user32
GetTabbedTextExtentA
DdeFreeDataHandle
WINNLSEnableIME
ShowCaret
GetInputDesktop
MenuItemFromPoint
CreateWindowExW
UnregisterClassW
DdeAddData
RegisterClassA
LoadMenuIndirectA
EnumPropsA
RegisterClassExA
DlgDirListW
WinHelpW
RealGetWindowClass
MessageBoxW
BeginDeferWindowPos
GetMessageW
SetWinEventHook
CharToOemA
InSendMessage
EnumDisplaySettingsA
DrawTextA
ShowWindow
DefMDIChildProcW
GetKeyboardState
PackDDElParam
GetSystemMetrics
comctl32
ImageList_GetImageInfo
InitCommonControlsEx
ImageList_EndDrag
GetEffectiveClientRect
ImageList_LoadImage
ImageList_Remove
CreateStatusWindowW
ImageList_BeginDrag
ImageList_LoadImageA
DestroyPropertySheetPage
Sections
.text Size: 457KB - Virtual size: 457KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ