Static task
static1
Behavioral task
behavioral1
Sample
3e178886ccf74911dd6cbcf73e9f9f89.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3e178886ccf74911dd6cbcf73e9f9f89.exe
Resource
win10v2004-20231222-en
General
-
Target
3e178886ccf74911dd6cbcf73e9f9f89
-
Size
20KB
-
MD5
3e178886ccf74911dd6cbcf73e9f9f89
-
SHA1
b5a33d8bbdb3a9a6510e184be4b6d3d11c9092c3
-
SHA256
03e242202433c69ea1a27eb4972be640c504335a8266033713939668a6a3438a
-
SHA512
2488aa8805af0940a2160bbd95ff0fc3da002f4ea5a8e76ad0df525d6bfee91ad9af9f940d39d514b5e39766567cf21fb0af02d4bba90796fa5a5b1d82afcd01
-
SSDEEP
384:BfNhShmHBcNEEdILbqSeEgoldwxrtsLTIKbb8ohB197MHzt5WExhN:0QqhETlqxrAhXnhD976zt51xr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e178886ccf74911dd6cbcf73e9f9f89
Files
-
3e178886ccf74911dd6cbcf73e9f9f89.exe windows:6 windows x86 arch:x86
087fa4b83f7793ea60a7e09e5a939227
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegCloseKey
kernel32
HeapAlloc
GetProcessHeap
ExitProcess
CreateProcessA
GetEnvironmentVariableA
lstrcatA
GetShortPathNameA
lstrlenA
lstrcpyA
GetCommandLineA
GetEnvironmentStringsW
WriteProcessMemory
VirtualAllocEx
CloseHandle
GetThreadContext
CreateThread
ReadFile
GetFileSize
CreateFileA
WriteFile
lstrcatW
lstrcpyW
GetEnvironmentVariableW
GlobalAlloc
Sleep
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
shlwapi
PathFindFileNameA
ntdll
CsrClientCallServer
NtWriteVirtualMemory
NtAllocateVirtualMemory
wcslen
RtlDestroyProcessParameters
RtlCreateProcessParameters
NtResumeThread
NtCreateThread
NtProtectVirtualMemory
NtQueryInformationProcess
NtCreateProcess
NtQuerySection
NtClose
NtCreateSection
NtOpenFile
RtlInitUnicodeString
strlen
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 474B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ