Static task
static1
Behavioral task
behavioral1
Sample
3cf3bd46056a87ca9995e7606ae0dc57.exe
Resource
win7-20231215-en
General
-
Target
3cf3bd46056a87ca9995e7606ae0dc57
-
Size
169KB
-
MD5
3cf3bd46056a87ca9995e7606ae0dc57
-
SHA1
a256d1b4434ef1570601a656f50577b50463343b
-
SHA256
2a2038310ee90066c134b8e83e913615bd1eeab47ee5981038702171447818c3
-
SHA512
f73da4bdcaa0044d0d8571c191ae33196bf8af6543434b8eb40a516519e253d793cfeeae609e98dccfe7b32cfc0b747bc16d12a02a92e942ad21b367b259a0e3
-
SSDEEP
3072:kiIC4sHQAfZBTWiBsoTXx4hIOcXGQiHkFwXcMUOkbyV:kiJ4swATTWiBsoTYIOcXGzUOn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cf3bd46056a87ca9995e7606ae0dc57
Files
-
3cf3bd46056a87ca9995e7606ae0dc57.exe windows:5 windows x64 arch:x64
7f4f2fdfb22e2a8ace503ee228024370
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemWow64DirectoryA
LoadLibraryW
Sleep
SizeofResource
GetSystemDirectoryA
GetLastError
GetProcAddress
SetFileAttributesA
Process32FirstW
LockResource
GetModuleFileNameA
Process32NextW
CreateToolhelp32Snapshot
WriteFile
CloseHandle
GetTempPathA
LocalFileTimeToFileTime
FreeLibrary
WaitForSingleObject
CreateRemoteThread
OpenProcess
GetSystemDirectoryW
VirtualFreeEx
GetVersionExW
VirtualAllocEx
WriteProcessMemory
GetWindowsDirectoryA
SetFileTime
GetModuleHandleW
GetCurrentProcess
SystemTimeToFileTime
LoadResource
FindResourceW
FreeResource
OutputDebugStringA
CreateFileA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
advapi32
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
RegOpenKeyExA
LookupPrivilegeValueW
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegQueryValueExA
shell32
ShellExecuteA
msvcr90
_amsg_exit
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_wcsicmp
fclose
strrchr
fwrite
fopen
remove
_errno
malloc
free
sprintf
memcpy
memset
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 153KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ