_ReflectiveLoader@4
Static task
static1
Behavioral task
behavioral1
Sample
win_x86.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
win_x86.exe
Resource
win10v2004-20231215-en
General
-
Target
win_x86.exe
-
Size
4.5MB
-
MD5
2e53ffc79553eb78866fdd756d658545
-
SHA1
2c7b713ca9e1f4e200f68417eaaca1168dddea27
-
SHA256
bf18cf5489b28a5a1e3ca508d5dd9e765fc2e35a4d79f128af5c533562bf0790
-
SHA512
8c193d11d6af6c0ab1e68386ba7970f0c14d15db21dd26d59c3100fff416e31b162f29ea87fba5a3476793dea8789485d82aac95d1ca909ff14ebc4fe9e021e7
-
SSDEEP
98304:3hMJ/oMZqW8mHe+9js510BFM43xlIqYl4afUIP0I8VLGGO4y62HryD1xwzfU:3hoJkWfVM0BCWiqSNUIMIHG7Jmzc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource win_x86.exe
Files
-
win_x86.exe.exe windows:5 windows x86 arch:x86
b5b9478e975153d0ed57f53a06d5c629
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
DestroyWindow
RegisterClassExA
MsgWaitForMultipleObjects
TranslateMessage
UnregisterClassA
CreateWindowExA
PeekMessageA
DefWindowProcA
DispatchMessageA
advapi32
CreateProcessAsUserA
kernel32
HeapSize
lstrlenA
FreeConsole
FreeLibrary
VirtualFree
VirtualQueryEx
OpenProcess
Thread32First
Thread32Next
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LoadLibraryA
OpenThread
CreateToolhelp32Snapshot
GetVersionExA
CloseHandle
WriteProcessMemory
ResumeThread
GetCurrentThreadId
CreateThread
CreateRemoteThread
GetModuleHandleA
GetThreadContext
SetThreadContext
CreateProcessA
TerminateProcess
CreatePipe
FindResourceA
GetModuleHandleExA
FindResourceExW
FindResourceW
LoadResource
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
InitializeCriticalSection
FindResourceExA
WideCharToMultiByte
LoadLibraryW
SizeofResource
LeaveCriticalSection
GetModuleFileNameW
MultiByteToWideChar
EnterCriticalSection
LocalAlloc
GetModuleFileNameA
LoadLibraryExA
LocalFree
CreateFileA
GetNativeSystemInfo
VirtualQuery
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
GetThreadLocale
CreateFileMappingA
VirtualProtect
GetCommandLineW
SetErrorMode
GetCurrentProcess
GetCommandLineA
GetStartupInfoA
Sleep
ExitProcess
HeapReAlloc
SetConsoleCtrlHandler
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 267KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xzdata Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ