Static task
static1
Behavioral task
behavioral1
Sample
13b8bbc2af03279a3b0724c26faa4b41.exe
Resource
win7-20231215-en
General
-
Target
13b8bbc2af03279a3b0724c26faa4b41
-
Size
132KB
-
MD5
13b8bbc2af03279a3b0724c26faa4b41
-
SHA1
f4e59207391c342bc02246cb18bc0a7e8d24992a
-
SHA256
2c29c28870debe11945d6e93f6c25e3e25eb8cca13cdd85c22d4284acd75fb35
-
SHA512
b57275084caabf3792429eb0c0f91b0ce9fbe6040e17e02e032afca6ffcaa97f7da25dec74542a67d59e3a8cc8c00a826d88b672f333eceb83bf0ef61ccb9c80
-
SSDEEP
3072:pz2I160QAs6E8OOklGhYUrdsVoXNCJvSGKQ7:F2IFs6DhYisGCJKGKQ7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 13b8bbc2af03279a3b0724c26faa4b41
Files
-
13b8bbc2af03279a3b0724c26faa4b41.exe windows:4 windows x86 arch:x86
fec89686008c5f909edc9ee2aeb2a6e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACloseEvent
WSAGetOverlappedResult
WSASocketA
WSAConnect
WSAAddressToStringA
wtsapi32
WTSQueryUserToken
WTSLogoffSession
WTSOpenServerA
WTSCloseServer
mpr
WNetGetUserA
WNetGetUniversalNameA
WNetGetConnectionA
netapi32
NetApiBufferFree
NetWkstaSetInfo
NetWkstaGetInfo
setupapi
SetupQueueCopySectionA
SetupAddInstallSectionToDiskSpaceListA
SetupAddSectionToDiskSpaceListA
SetupInstallFromInfSectionA
SetupRemoveSectionFromDiskSpaceListA
SetupOpenLog
SetupCloseLog
SetupInitializeFileLogA
SetupRemoveInstallSectionFromDiskSpaceListA
SetupInstallServicesFromInfSectionA
SetupFindNextLine
SetupFindFirstLineA
SetupRemoveFileLogEntryA
wintrust
WinVerifyTrust
kernel32
SetFilePointer
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
IsBadWritePtr
HeapReAlloc
VirtualAlloc
FatalAppExitA
HeapAlloc
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetCurrentThread
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
GetStartupInfoA
GetFileType
CreateProcessA
GetProfileStringW
FindNextChangeNotification
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
CloseHandle
WriteFile
InitializeCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 825KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ