Static task
static1
Behavioral task
behavioral1
Sample
0b7828b6bcaf23922ccebad711dc1796a91e8631637e4906e4698e88888553d3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0b7828b6bcaf23922ccebad711dc1796a91e8631637e4906e4698e88888553d3.exe
Resource
win10v2004-20231215-en
General
-
Target
0b7828b6bcaf23922ccebad711dc1796a91e8631637e4906e4698e88888553d3
-
Size
720KB
-
MD5
752aa7e794bd540e98bb6e2fec3c3ceb
-
SHA1
2b83e97ff3c43cb52615f1c7eac45d83dea3d08f
-
SHA256
0b7828b6bcaf23922ccebad711dc1796a91e8631637e4906e4698e88888553d3
-
SHA512
a55bc0eed27cd587b1a84769894302920f178574fdaa5aff4f60a9890807728fb889e93d01b4d96432f591a25bd10bf6d9245a05dd21048d4d10f749812f149f
-
SSDEEP
12288:CGcAw41M3bjE8xUXgBSC44gZytg2Ek18O2a0UxGK3JT1UVF90ZYnB8gk51VPx:CGZNSUX+4jytg2ao3jUb90Vr1VPx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b7828b6bcaf23922ccebad711dc1796a91e8631637e4906e4698e88888553d3
Files
-
0b7828b6bcaf23922ccebad711dc1796a91e8631637e4906e4698e88888553d3.exe windows:6 windows x86 arch:x86
35d8d247f1cbde467691a1e853c8e923
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceW
GetProcAddress
FreeLibrary
ReadFile
FindNextFileW
lstrlenW
WriteFile
lstrcpynW
SetFilePointer
FindClose
CreateFileW
GetFileSize
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCommandLineW
OutputDebugStringA
FormatMessageW
lstrcatW
GetWindowsDirectoryW
LocalFree
FlushFileBuffers
GetFileSizeEx
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
Sleep
DeleteFileW
CreateDirectoryW
FindFirstFileExW
TerminateProcess
LoadResource
GetFileAttributesW
GetModuleHandleW
GetExitCodeProcess
SetEndOfFile
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindResourceExW
LoadLibraryW
LockResource
OutputDebugStringW
SizeofResource
CreateThread
GetConsoleWindow
HeapFree
WideCharToMultiByte
CopyFileW
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
Process32FirstW
Process32NextW
GetLastError
MultiByteToWideChar
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileAttributesExW
CreateProcessW
GetConsoleMode
GetConsoleCP
GetFileType
SetFilePointerEx
GetCommandLineA
GetStdHandle
GetTimeZoneInformation
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
CreateToolhelp32Snapshot
HeapSize
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetCurrentProcess
WaitForSingleObject
GetStartupInfoW
IsProcessorFeaturePresent
SetLastError
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsDebuggerPresent
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteConsoleW
user32
ExitWindowsEx
ShowWindow
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptReleaseContext
CryptDestroyKey
CryptAcquireContextW
CryptVerifySignatureW
OpenProcessToken
oleaut32
SysAllocStringLen
ws2_32
recv
setsockopt
WSAGetLastError
socket
WSAStartup
getaddrinfo
listen
closesocket
bind
accept
WSACleanup
ioctlsocket
htons
inet_ntoa
ntohs
send
inet_addr
freeaddrinfo
crypt32
CryptImportPublicKeyInfo
CryptDecodeObjectEx
userenv
GetAllUsersProfileDirectoryW
Sections
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 412KB - Virtual size: 1008KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ