Static task
static1
Behavioral task
behavioral1
Sample
2ca956342fa18adecf3a1c677477c206.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2ca956342fa18adecf3a1c677477c206.exe
Resource
win10v2004-20231222-en
General
-
Target
2ca956342fa18adecf3a1c677477c206
-
Size
8.7MB
-
MD5
2ca956342fa18adecf3a1c677477c206
-
SHA1
8be3e6ef612a61b2718cf262463f30077f504caf
-
SHA256
448914d0b5a0af652993a1082e506d6c76351cde56e5badd44a3d03981408ba3
-
SHA512
c2a3d25a23874771b8bddcedc7237d93598becd16c3724dd4eb23e0ba95e4901fe8126cd617aa6b6d12e663b4ba9e7ee2c73c24255b1ec33a0a0f761b46d39a6
-
SSDEEP
98304:vEx5Tf5sH9YrQ8QAHS8VHaxEx5Tf5iH9YrQ8QAHS8VHa:MhsH9YrQ8QAHS8V7hiH9YrQ8QAHS8V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ca956342fa18adecf3a1c677477c206
Files
-
2ca956342fa18adecf3a1c677477c206.exe windows:6 windows x86 arch:x86
37dff8bcc66cee59519fee56b3f7772d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ws2_32
ioctlsocket
htonl
ntohl
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
gethostname
crypt32
CertFreeCertificateContext
wldap32
ord143
ord46
ord211
ord60
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
normaliz
IdnToAscii
kernel32
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetCommandLineA
GetFileAttributesExW
SetEndOfFile
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryW
GetCommandLineW
GetFileSizeEx
LCMapStringW
CompareStringW
HeapReAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
HeapSize
WriteConsoleW
GetEnvironmentStringsW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
VirtualAlloc
VirtualFree
VirtualProtect
IsBadReadPtr
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
HeapAlloc
GetProcessHeap
HeapFree
FindResourceW
ExitProcess
LoadResource
LockResource
GetModuleFileNameW
GetTempPathW
CopyFileW
CreateProcessW
SetPriorityClass
SetThreadPriority
ResumeThread
DeleteFileW
SizeofResource
CreateFileW
Sleep
WriteFile
CloseHandle
GetLastError
CreateFileA
ReadFile
DeleteFileA
GetTickCount64
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
FormatMessageA
WaitForSingleObjectEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
DecodePointer
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
Sections
.text Size: 387KB - Virtual size: 387KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ