Static task
static1
Behavioral task
behavioral1
Sample
282e86dfc6a55b5c1411919f8ca6a059.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
282e86dfc6a55b5c1411919f8ca6a059.exe
Resource
win10v2004-20231215-en
General
-
Target
282e86dfc6a55b5c1411919f8ca6a059
-
Size
33KB
-
MD5
282e86dfc6a55b5c1411919f8ca6a059
-
SHA1
bcee2f3048db7ac97650cf8bd9b4bfcdbc5565ac
-
SHA256
9dc11fa06d9a71fa786726bf3e902e81f3a10fda7b5e7fb8f9885432d3d15f47
-
SHA512
257ae8314c642d794c4f2ed6d99f19eb64c3d5a67750228dd585e1309cf40d7a2e1258fef085db759da0da2f09770147bf8ad7a73a8803641e0f341b2e73a305
-
SSDEEP
384:+RnFbBh3z3r39n3c8dMdOuMuqFn3rVaGEg0pvIQ4yKSDshEipJgLa0Mp8Bf5KKYJ:InFbsqFbXEgKjCgLa1EsKYdmCb0P4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 282e86dfc6a55b5c1411919f8ca6a059
Files
-
282e86dfc6a55b5c1411919f8ca6a059.exe windows:4 windows x86 arch:x86
01936cb346e1700b24f4d74b2b666c88
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
lstrcatA
lstrcpyA
CreateFileA
GetFileAttributesA
CreateDirectoryA
GetSystemDirectoryA
lstrlenA
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
ExitThread
Sleep
DeleteFileA
TerminateThread
WaitForMultipleObjects
GetModuleFileNameA
GetLastError
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetProcessHeap
ReadFile
SetFilePointer
CloseHandle
LoadLibraryA
ResumeThread
SetEndOfFile
GetProcAddress
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
CreateEventA
SetEvent
CreateThread
WaitForSingleObject
CreateProcessA
CompareStringA
SizeofResource
LoadResource
FindResourceA
lstrcmpA
ResetEvent
user32
wsprintfA
advapi32
RegEnumKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyA
RegOpenKeyA
RegNotifyChangeKeyValue
RegCloseKey
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 684B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ