Static task
static1
Behavioral task
behavioral1
Sample
2b25182df120e15147a1d1f86154ece9.exe
Resource
win7-20231129-en
General
-
Target
2b25182df120e15147a1d1f86154ece9
-
Size
653KB
-
MD5
2b25182df120e15147a1d1f86154ece9
-
SHA1
8dfb7bb6a85f51a09db361fb83f5edfdb4c5e515
-
SHA256
61b5b2ea5f667c7a3bc7ef2ac07283a0c106e7d02e139879481ffa64441e1e55
-
SHA512
a25709a82d7d152a5d2321904154ecced9753fa6158546ba6eddb3c4e8fb1bac565f991951abe6fc9761ed2d21765ab828c4097e7b8a7a21572718c595272cf1
-
SSDEEP
12288:WqeAoQME4xL3Lq7ZAfsOU+1kGz9nHxUHmCrv+rc:Wq1oldxTLoZcsOUaTzjumKv+rc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2b25182df120e15147a1d1f86154ece9
Files
-
2b25182df120e15147a1d1f86154ece9.exe windows:6 windows x86 arch:x86
f074115ebeb6621682ea6e2795fa238f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenMutexA
SetConsoleOutputCP
GetModuleFileNameA
FindFirstChangeNotificationA
CreateMutexA
GetCurrentDirectoryA
GetFileTime
DuplicateHandle
GetCurrentProcessId
DeleteFileA
GetLocalTime
WriteConsoleW
SetStdHandle
GetStringTypeW
LoadLibraryW
WaitForMultipleObjectsEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
ResetEvent
GetEnvironmentVariableA
VirtualProtectEx
GetSystemDirectoryA
CreateSemaphoreA
SetConsoleCP
GetCurrentThread
GetTimeFormatA
PeekNamedPipe
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCPInfo
GetOEMCP
CloseHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentThreadId
GetExitCodeThread
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
GetLastError
CreateThread
ExitThread
LoadLibraryExW
RaiseException
RtlUnwind
HeapFree
TryEnterCriticalSection
CreateTimerQueue
RtlCaptureStackBackTrace
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
IsDebuggerPresent
GetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
HeapAlloc
GetProcessHeap
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetConsoleCtrlHandler
FatalAppExitA
OutputDebugStringW
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
SetProcessAffinityMask
ReleaseSemaphore
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
HeapReAlloc
IsValidCodePage
GetACP
CreateFileW
user32
ReleaseCapture
EndDialog
OffsetRect
SetDlgItemInt
LoadIconA
InsertMenuItemA
GetDlgItemInt
SetCursor
GetMessageA
CloseClipboard
gdi32
CreatePatternBrush
CreateRectRgnIndirect
comctl32
InitCommonControlsEx
ImageList_SetBkColor
ImageList_AddMasked
ImageList_SetIconSize
ImageList_Destroy
ImageList_Remove
loadperf
SetServiceAsTrustedA
UnloadPerfCounterTextStringsA
mgmtapi
SnmpMgrRequest
SnmpMgrClose
SnmpMgrOpen
SnmpMgrCtl
Sections
.text Size: 347KB - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 715KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ