Static task
static1
Behavioral task
behavioral1
Sample
2a696599b1cbfa21727c932625f17129.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2a696599b1cbfa21727c932625f17129.exe
Resource
win10v2004-20231215-en
General
-
Target
2a696599b1cbfa21727c932625f17129
-
Size
4.2MB
-
MD5
2a696599b1cbfa21727c932625f17129
-
SHA1
fa34c82b34d5dc7dee0c0cbc147dce7c01638836
-
SHA256
b01f725dfdf6cb3c388883b563cd4615c4403a0270121e2f26eebbd707c41b33
-
SHA512
7d8590ba1a1c9d1c63405f7930c00fced4d86c9d0778f528aef70a38915cf4148d3eb23f3f75b002f826f3ac505873bebe186d511eacf03ea8bd5b4cecccc1c1
-
SSDEEP
98304:D9NnZfjxAZWhv7Stgc9IW1dXgfC/MHmg:TvU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a696599b1cbfa21727c932625f17129
Files
-
2a696599b1cbfa21727c932625f17129.exe windows:6 windows x86 arch:x86
4b540122e47bd952474dff889d5cdec9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegCloseKey
IsValidSid
FreeSid
CreateWellKnownSid
EqualSid
RegGetValueW
EventWriteTransfer
EventRegister
EventUnregister
kernel32
HeapFree
CreateEventExW
GetCurrentProcess
GetModuleFileNameW
CreateMutexW
OpenEventW
Sleep
GetLastError
SetEvent
CloseHandle
GetCurrentProcessId
GetProcessHeap
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentThread
GetThreadTimes
FindNextFileW
FindClose
CreateFileW
GetModuleHandleA
GetProcAddress
SetFilePointerEx
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
LCMapStringW
FreeLibrary
LocalFree
FormatMessageA
FindFirstFileExW
IsWow64Process
ReleaseSemaphore
GlobalFree
HeapAlloc
SetLastError
GetStringTypeW
GlobalMemoryStatusEx
RaiseException
LoadLibraryExW
GetModuleHandleW
GetVersionExW
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount64
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
FindResourceW
SizeofResource
LoadResource
IsValidCodePage
FileTimeToSystemTime
FormatMessageW
GetLogicalProcessorInformation
WaitForSingleObjectEx
SignalObjectAndWait
GetProcessAffinityMask
CreateWaitableTimerW
GetCurrentThreadId
QueryDepthSList
TryEnterCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetFileType
WriteFile
FlsAlloc
TlsAlloc
FlsFree
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetModuleHandleExW
K32GetProcessMemoryInfo
LoadLibraryExA
VirtualQuery
GetSystemInfo
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
EnumSystemLocalesW
IsValidLocale
GetACP
DuplicateHandle
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
GetTickCount
GetLocaleInfoW
GetCPInfo
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
CreateTimerQueue
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
VirtualAlloc
VirtualProtect
VirtualFree
UnregisterWaitEx
LoadLibraryW
HeapSize
HeapReAlloc
GetStdHandle
ExitProcess
ole32
StringFromGUID2
CoCreateGuid
Sections
.text Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 202KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c2r Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ