Static task
static1
Behavioral task
behavioral1
Sample
0f8cff105bacb67d621b379e2fba9de5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f8cff105bacb67d621b379e2fba9de5.exe
Resource
win10v2004-20231215-en
General
-
Target
0f8cff105bacb67d621b379e2fba9de5
-
Size
27KB
-
MD5
0f8cff105bacb67d621b379e2fba9de5
-
SHA1
92806de3d890c39cad47fe675a158809fc35ca1f
-
SHA256
2f08f37346ac19fbbd90fd2ea5cbaa17d381b0ba0978e33d8189479a6be698ca
-
SHA512
64a184139e2ecadf4800d290ec5fa1a5ccb3969baa332d3de93ff7925c1518242562557e42657feb08e41abdfe4dc9facdfef80f55271b39de5fb2404c986b59
-
SSDEEP
384:nBB+LVabRI4Jfd2VedvQbyLMKMu4Y8t/cu1e8UgwI7NH0lz3Rx7Gso2LJBC4NOl7:njJRI4xYbqM8bW/5LMDQdu26
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f8cff105bacb67d621b379e2fba9de5
Files
-
0f8cff105bacb67d621b379e2fba9de5.exe windows:4 windows x86 arch:x86
91443feb4144db5b68c0b76d89542753
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
lstrcpyA
SetThreadPriority
GetCurrentThread
GetCurrentProcess
Sleep
FindFirstFileA
GetModuleFileNameA
InterlockedDecrement
WideCharToMultiByte
lstrlenW
lstrlenA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateProcessW
GetStartupInfoW
CreateFileA
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileA
GetLocalTime
ReadFile
SetFilePointer
SetFileAttributesA
WriteFile
GetCurrentDirectoryA
CreateThread
GetWindowsDirectoryA
ExitProcess
GlobalMemoryStatus
LoadLibraryA
OpenMutexA
MultiByteToWideChar
CreateToolhelp32Snapshot
LocalFree
GetLastError
Process32First
Process32Next
OpenProcess
WritePrivateProfileStringW
CloseHandle
user32
wsprintfW
GetWindowThreadProcessId
SendMessageA
FindWindowExA
wsprintfA
IsWindow
CharUpperA
FindWindowA
advapi32
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetNamedSecurityInfoA
shell32
SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListA
�`
CoCreateI̿�j
OleRun
CoInitialize
ord2
ord4
ord149
ord8
ord10
ord9
ord6
ord7
ord200
_controlfp
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ