Static task
static1
Behavioral task
behavioral1
Sample
1738d00e49cb534c1687319e8462d7d8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1738d00e49cb534c1687319e8462d7d8.exe
Resource
win10v2004-20231215-en
General
-
Target
1738d00e49cb534c1687319e8462d7d8
-
Size
175KB
-
MD5
1738d00e49cb534c1687319e8462d7d8
-
SHA1
721930c638b64bbbeef864f988627b95e3ad6c04
-
SHA256
03c6ef137eeaf103f0e3a154e5f57a1658bb82051f5754988b6c5bc7551a1976
-
SHA512
1da49343cebc33bc98a90167adc9cbfea387c6238759aaab4c1a691a3ccf0f7f38cf3f7e089d6ff076a09e716ad08095c19945a7f5ed9d45a251ac97d07b7536
-
SSDEEP
3072:hjkhvYn2Kmn+qJGUSJEHKn+xP5AR2j90dwXEX4Bm6FgFjw4MaxKx:dkNO23FJGN+xRxj9eEhE6Aj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1738d00e49cb534c1687319e8462d7d8
Files
-
1738d00e49cb534c1687319e8462d7d8.exe windows:5 windows x86 arch:x86
6b04a8b3bd5224f7d1c2fdec5063ef9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
�
�pA
_3�[�C����U����|��pA
�� �� u�M̉�M�_3�[�C���Ë�U����|��pA
]���@u �M̋U��Y�� �� u�M̉�M�_3�[�C���Ë�U����|��pA
��
�1�t����d��
��M�Z+�;�|�1�t����d��
E��EFW�E��}��M��u��M��M��M��M��M��M��M�9M$u��[���
�|Ћ�j���M�Z+�;�|�1�t����d��
��}ԋM����E��}��}�|Ћ�j���M�Z+�;�|�1�t����d��
����#ΉMԋ����M�}؉|���}ԋM����E��}��}�|Ћ�j���M�Z+�;�|�1�t����d��
E�
e��������������
����d��
�u��M��M��M��M��M��M��M�9M$u��[���
e�
lA
�����
�d��
|Ӌ�j���M�Z+�;�|�1�t����d��
�Mԋ����M�u؉3�u����E��}��u�|Ӌ�j���M�Z+�;�|�1�t����d��
��]��\���3��#ωMԋ����M�u؉3�u����E��}��u�|Ӌ�j���M�Z+�;�|�1�t����d��
�
��M�
HeapAlloc
�M�yщM܋MЃ����jY
+�3����}�
A
𫫫�
��ȍ}𥙃�¥������
��
��B�e�
�
���M�u؉3�u����E��}��u�|Ӌ�j���M�Z+�;�|�1�t����d��
���M�Z+�;�|�1�t����d��
��d��
��5�A
�
��\���Mԅ��
��
҅T����|��
|��f�ƙjY#������
��
�F�e�
L���1�<;�r;�s�E�
s�E�
9�M����t�L����r3�;�r��s3�G�1��HyދMԃ����
�r3�;�r��s3�G�1��HyދMԃ����
yދMԃ����
�|��+�3���� �A
Q����
����M�u؉3�u����E��}��u�|Ӌ�j���M�Z+�;�|�1�t����d��
�E��}��u�|Ӌ�j���M�Z+�;�|�1�t����d��
��j���M�Z+�;�|�1�t����d��
�1�t����d��
3�X�S
A
�����������
B�e�
�M�u؉3�u����E��}��u�|Ӌ�j���M�Z+�;�|�1�t����d��
��u�|Ӌ�j���M�Z+�;�|�1�t����d��
�M�Z+�;�|�1�t����d��
M��M��M�9M$u��[���
�=�a
�e�
3��}���j�X��
�3�9\��u @��|�3���
M��E������u'3�3�9\��u @��|�3���
ȋH�M��H�
��H S�ف�
ʼnE��E�M�M��H S�ف�
��U����8��pA
��M�_3�[�dH����U����8��pA
�� �� u�M̉�M�_3�[�dH���Ë�U����8��pA
M̋U��Y�� �� u�M̉�M�_3�[�dH���Ë�U����8��pA
|A
���M���Ɂ�
y�3�^jY+ xA
t����d��
j���M�Z+�;�|�1�t����d��
M����E��}��}�|Ћ�j���M�Z+�;�|�1�t����d��
�}؉|���}ԋM����E��}��}�|Ћ�j���M�Z+�;�|�1�t����d��
���#ΉMԋ����M�}؉|���}ԋM����E��}��}�|Ћ�j���M�Z+�;�|�1�t����d��
�҅t����|��
+�@���MЅ��
�]ԉE�yJ���B�t��j3�Y+�@���MЅ��
����W��
�E�����҅T����|��
���z�}�;�r��s�e�
���
r"9U����t+�e�
���L���9��}��99}�r"9U����t+�e�
�s�e�
ord17
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ