Static task
static1
Behavioral task
behavioral1
Sample
111508ff94e2a98cd7e06dc3cbda4800.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
111508ff94e2a98cd7e06dc3cbda4800.exe
Resource
win10v2004-20231215-en
General
-
Target
111508ff94e2a98cd7e06dc3cbda4800
-
Size
13.1MB
-
MD5
111508ff94e2a98cd7e06dc3cbda4800
-
SHA1
905a62617dc5123ea8bb85c57836ce7d49ad41e8
-
SHA256
692046b0c10afc4cbcc958412de344c8db1a7dfe03bba146aa4adfd258055baf
-
SHA512
c09a88fdc99ca068a6814215270061b26b8f6ce64d8b1d6cacb0407d1b3f83e08d28bb959a5ce0dd47dbbb2bd5bf7c9d2111e12eb300faaf0016be25709be359
-
SSDEEP
24576:0CKmbpaVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVP:kI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 111508ff94e2a98cd7e06dc3cbda4800
Files
-
111508ff94e2a98cd7e06dc3cbda4800.exe windows:5 windows x86 arch:x86
a9846ce1b092483e13eb4ec129769170
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
ResumeThread
ClearCommBreak
GetSystemRegistryQuota
GetSystemTimes
GetTickCount
GetSystemTimeAdjustment
lstrcmpA
lstrcatW
_lcreat
CreateSemaphoreW
OpenFileMappingA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetCommandLineA
ExpandEnvironmentStringsA
GetFirmwareEnvironmentVariableA
SwitchToThread
EnumResourceLanguagesA
FindAtomW
GetTempPathW
FindFirstFileExW
MoveFileExW
CreateHardLinkW
IsBadStringPtrA
OpenJobObjectA
FindNextVolumeMountPointW
DeleteVolumeMountPointW
ZombifyActCtx
GetNumaHighestNodeNumber
EnumDateFormatsW
GetSystemDefaultLangID
GetCurrentConsoleFont
WriteConsoleA
CloseHandle
WriteConsoleW
HeapUnlock
GlobalAlloc
GetProcAddress
SetFirmwareEnvironmentVariableA
InterlockedIncrement
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineW
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
ExitProcess
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
SetLastError
GetCurrentThread
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
CreateFileW
user32
GetMonitorInfoW
advapi32
RegSetValueExW
PrivilegedServiceAuditAlarmA
ReportEventA
QueryServiceLockStatusW
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 97KB - Virtual size: 49.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12.8MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ