Static task
static1
Behavioral task
behavioral1
Sample
26851a4ebc9e340599282262f91de1cb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
26851a4ebc9e340599282262f91de1cb.exe
Resource
win10v2004-20231215-en
General
-
Target
26851a4ebc9e340599282262f91de1cb
-
Size
1.2MB
-
MD5
26851a4ebc9e340599282262f91de1cb
-
SHA1
6f8b576ec24b7ae800cb2e86524df97e37421ce8
-
SHA256
d1395e5a53e5cbdbbe06dbae07a5f2e932b22cd7719d696de3cb3146cb27342f
-
SHA512
2569cb219ff43990c4152c312f399a9455f88e70f4cae358db0494ccd7a355e7f1333ab6e2559b27821d2f51c309d86fd9f74ed288f5fb9e966d96a8cf0420b2
-
SSDEEP
12288:fOOOOOqxGqAEqDn5bAaLBJvQinXRTUjfi6VN8iTl6xIuybAybAybAybAybAybAyR:7xFAjrLISRUjfiy8i8b/s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26851a4ebc9e340599282262f91de1cb
Files
-
26851a4ebc9e340599282262f91de1cb.exe windows:4 windows
8d10b381be270d9db689a1ab19256b2d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessVersion
GetThreadPriority
GetEnvironmentStrings
GetFileType
GetShortPathNameA
FindFirstFileA
GetFileAttributesA
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetProcAddress
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
VirtualAlloc
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
InterlockedDecrement
InterlockedIncrement
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
Sleep
LCMapStringA
LCMapStringW
SetStdHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
CloseHandle
GetLocaleInfoW
GetEnvironmentStringsW
HeapAlloc
InterlockedExchange
ReadFile
advapi32
RegQueryValueA
RegOpenKeyExA
ws2_32
WSAHtons
WSAGetLastError
Sections
.zenc Size: 816KB - Virtual size: 812KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE