Static task
static1
Behavioral task
behavioral1
Sample
0c02f7cfe9bb871b7af3d7377bd50f28.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c02f7cfe9bb871b7af3d7377bd50f28.exe
Resource
win10v2004-20231222-en
General
-
Target
0c02f7cfe9bb871b7af3d7377bd50f28
-
Size
50KB
-
MD5
0c02f7cfe9bb871b7af3d7377bd50f28
-
SHA1
043d2aedae217a7242ab5e9176ffc6a8745ae8da
-
SHA256
3ffe2e93e54352033eab5d90fa81ebbb4e9bf68dbee783e903c8cc837797bd0a
-
SHA512
c1dd42d4be6e93073f6bfe462ab1cbc87e0d04ad710982cceb8e0b0f30f7ebc261bfcb3affe6a0f0cfaa74a2eb15441cd66dfa4731aaf7044c7a93006627909a
-
SSDEEP
768:HzmIIk4J2H2aN5A/qwQbd7zGecq+y64DotS8X58zyRrkij2UMSQyqs1wIdlYl:FyQHRddGx4DuS8J8zydc7Sxl1/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c02f7cfe9bb871b7af3d7377bd50f28
Files
-
0c02f7cfe9bb871b7af3d7377bd50f28.exe windows:5 windows x86 arch:x86
1efefc4bf6956f33d09ee454216db944
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleOutputCharacterA
RtlZeroMemory
EnumResourceNamesA
GlobalFree
EnumCalendarInfoExW
GetSystemWow64DirectoryW
GetVolumeInformationW
Process32NextW
GetGeoInfoA
SuspendThread
WriteConsoleOutputA
GetFileInformationByHandle
CancelTimerQueueTimer
GetTempPathW
GetModuleHandleA
CommConfigDialogA
SetFileShortNameA
IsSystemResumeAutomatic
DeleteTimerQueue
EnumSystemLocalesA
EnumResourceLanguagesW
GetComputerNameExA
GetOEMCP
WritePrivateProfileSectionW
lstrlenW
TransmitCommChar
RemoveDirectoryA
LoadLibraryW
GetNumberFormatW
CreateNamedPipeA
SetUserGeoID
msvcirt
??6ostream@@QAEAAV0@I@Z
?sputc@streambuf@@QAEHH@Z
??0streambuf@@IAE@XZ
?is_open@ofstream@@QBEHXZ
??1stdiostream@@UAE@XZ
?flush@@YAAAVostream@@AAV1@@Z
??1ios@@UAE@XZ
?tie@ios@@QBEPAVostream@@XZ
??4istrstream@@QAEAAV0@ABV0@@Z
?rdbuf@stdiostream@@QBEPAVstdiobuf@@XZ
??0stdiostream@@QAE@ABV0@@Z
?fd@ofstream@@QBEHXZ
??0ostream@@IAE@ABV0@@Z
?bitalloc@ios@@SAJXZ
mapi32
SzFindCh@8
ScRelocNotifications@20
FtgRegisterIdleRoutine@20
UlAddRef@4
MapStorageSCode@4
ScGenerateMuid@4
FBadRow@4
OpenStreamOnFile
HrSzFromEntryID@12
SetAttribIMsgOnIStg@16
HrAddColumns@16
MAPISendMail
BMAPISaveMail
EncodeID@12
MAPIInitialize
cmc_free
__ValidateParameters@8
FPropContainsProp@12
SzFindSz@8
WrapCompressedRTFStream@12
GetOutlookVersion
HrDecomposeEID@28
PRProviderInit
BMAPIGetAddress
MAPIResolveName
MAPIAdminProfiles@8
FBadPropTag@4
ntdll
RtlLengthSecurityDescriptor
KiUserApcDispatcher
RtlIpv4AddressToStringA
NtRestoreKey
RtlCustomCPToUnicodeN
NtSetSystemPowerState
RtlNtStatusToDosError
NtWaitHighEventPair
NtPrivilegeCheck
ZwSetDefaultUILanguage
RtlGetAce
RtlIpv6StringToAddressW
RtlTraceDatabaseCreate
NtCompareTokens
RtlQueueWorkItem
ZwAccessCheckByTypeResultListAndAuditAlarm
RtlQueryDepthSList
RtlAddAttributeActionToRXact
cos
RtlCreateUserThread
_stricmp
NtUnmapViewOfSection
ws2help
WahCloseThread
WahDisableNonIFSHandleSupport
WahReferenceContextByHandle
WahCompleteRequest
WahEnableNonIFSHandleSupport
WahCloseApcHelper
WahOpenCurrentThread
WahRemoveHandleContext
WahCreateSocketHandle
WahEnumerateHandleContexts
WahOpenHandleHelper
WahWaitForNotification
WahCreateHandleContextTable
WahOpenApcHelper
WahQueueUserApc
WahCloseNotificationHandleHelper
WahOpenNotificationHandleHelper
WahCloseSocketHandle
WahDestroyHandleContextTable
WahNotifyAllProcesses
WahInsertHandleContext
WahCloseHandleHelper
WahCreateNotificationHandle
netapi32
NetUserModalsSet
NetReplImportDirEnum
I_NetAccountSync
NetJoinDomain
DsRoleFreeMemory
I_NetServerPasswordGet
NetpGetConfigBool
NetEnumerateTrustedDomains
DsAddressToSiteNamesA
NetUserEnum
NetpwNameValidate
DsEnumerateDomainTrustsW
DsRoleDcAsDc
NetReplExportDirEnum
NetUseDel
NetBrowserStatisticsGet
RxNetAccessGetUserPerms
I_NetServerSetServiceBitsEx
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ