Static task
static1
Behavioral task
behavioral1
Sample
12c9d431bad207b78d4492fa384079aa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12c9d431bad207b78d4492fa384079aa.exe
Resource
win10v2004-20231215-en
General
-
Target
12c9d431bad207b78d4492fa384079aa
-
Size
266KB
-
MD5
12c9d431bad207b78d4492fa384079aa
-
SHA1
0013b85cf111d5b7720c1b1d4a348f41276e1756
-
SHA256
3ac81a6942ae4892b283baca674f5c036c12b59d38340b763733557396a04269
-
SHA512
ed6a314058dd2e53c1cf509b27b37a7b37fbea0ea09117de8dfa33fb916909020294c89a62aa599ebef1a7ed6013aaf6567b0ad34f4693af67bf64188b9cac46
-
SSDEEP
6144:QGl75MNTwpRAO02kWWIkFFNyL90lKKhjgcDRznAqnlC:Fl75MwRd0KGF+2gSdAglC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12c9d431bad207b78d4492fa384079aa
Files
-
12c9d431bad207b78d4492fa384079aa.exe windows:4 windows x86 arch:x86
02856246266695b606cad3a06af2d7cb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAGetLastError
WSACreateEvent
WSACloseEvent
socket
closesocket
gethostbyname
ntohs
send
recv
shutdown
connect
WSAEnumNetworkEvents
WSAAccept
htonl
htons
bind
listen
WSAEventSelect
inet_addr
gethostname
WSAStartup
urlmon
FindMimeFromData
kernel32
WaitForMultipleObjects
lstrlenW
lstrcpynW
CreateDirectoryW
WaitForSingleObject
LocalFree
CreateEventW
lstrcpyW
OpenEventW
CreateMutexW
GetModuleHandleW
GetTempPathW
GetTimeFormatW
GetDateFormatW
GetLocalTime
FreeLibrary
TlsAlloc
GetProcessHeap
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
GetProcAddress
advapi32
ConvertStringSidToSidW
CreateProcessAsUserW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
ControlService
DeleteService
CreateServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegConnectRegistryW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceW
QueryServiceStatus
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityInfo
GetSecurityDescriptorDacl
GetUserNameW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
DuplicateTokenEx
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
LookupAccountSidW
SetTokenInformation
ole32
CoCreateInstance
CoInitialize
CoUninitialize
user32
wsprintfW
quartz
AMGetErrorTextW
DllUnregisterServer
kbdpl
KbdLayerDescriptor
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.oxof Size: 4KB - Virtual size: 874KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.P Size: 4KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zRSiO Size: 1024B - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m Size: 98KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KboI Size: 1024B - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QWfT Size: 1024B - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hHWMk Size: 5KB - Virtual size: 555KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VRSfVp Size: 119KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uey Size: 2KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ