Static task
static1
Behavioral task
behavioral1
Sample
295d34c85d6807ca0339fab71cc44c39.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
295d34c85d6807ca0339fab71cc44c39.exe
Resource
win10v2004-20231215-en
General
-
Target
295d34c85d6807ca0339fab71cc44c39
-
Size
22KB
-
MD5
295d34c85d6807ca0339fab71cc44c39
-
SHA1
6f862e685e8e08872119b35ea9e7e28706bb569c
-
SHA256
3bf13eb417aaf5b99ba8b8299721ba14396655a01d82dc907704bee5e9d06796
-
SHA512
346d5eaeea845042c05af3be454452edb58a6937db716368937a75c632228f21f25fad1dbb06ae9b74c39f9129503f30fe8de9cceba4b526e7b917d48a81da9c
-
SSDEEP
384:B68X0GK1FNmsJfFmEPIGP9tA0Ffl4w44vNRLtNiXXN19ZgWDE8vQW:I8X0BFNhMU9tA0Ffqw44vNRLLiXXr9Vv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 295d34c85d6807ca0339fab71cc44c39
Files
-
295d34c85d6807ca0339fab71cc44c39.exe windows:4 windows x86 arch:x86
018e455e8c009b02d8d2fcd10407ada2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord823
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strncmp
printf
fopen
fwrite
fclose
_strcmpi
kernel32
ResumeThread
SizeofResource
GetStartupInfoA
CreateThread
WaitForSingleObject
ExitProcess
GetSystemDirectoryA
DeleteFileA
CopyFileA
GetModuleFileNameA
GetShortPathNameA
GetEnvironmentVariableA
lstrcpyA
lstrcatA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
OpenProcess
LockResource
LoadResource
CreateToolhelp32Snapshot
FindResourceA
Process32Next
Process32First
CreateProcessA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
shell32
ShellExecuteA
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ