Static task
static1
Behavioral task
behavioral1
Sample
96f74cd8f60f887235dd9cde75a4fc6a22be19d4fb4e74be384f28d1b338e04c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
96f74cd8f60f887235dd9cde75a4fc6a22be19d4fb4e74be384f28d1b338e04c.exe
Resource
win10v2004-20231215-en
General
-
Target
96f74cd8f60f887235dd9cde75a4fc6a22be19d4fb4e74be384f28d1b338e04c
-
Size
1.6MB
-
MD5
431c63a37c256ef2cd591f79bc6d2560
-
SHA1
a1321cbebe80c66c4b9fc0c4200cb12bb3b35ddb
-
SHA256
96f74cd8f60f887235dd9cde75a4fc6a22be19d4fb4e74be384f28d1b338e04c
-
SHA512
fd191c2990fbc3802d3ba88fa7cf066734bce36215f8e8925cfbeaf25fb13fe27f09519fdfef9c3a4aeaf8ed7efb1686180b55ff4cffa7b3eea474c981247b57
-
SSDEEP
49152:Qp5zIDy2meR5BqBWEB00zkhvNCikx7nv:Qp5zeR5BlERzkpNCikx7n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96f74cd8f60f887235dd9cde75a4fc6a22be19d4fb4e74be384f28d1b338e04c
Files
-
96f74cd8f60f887235dd9cde75a4fc6a22be19d4fb4e74be384f28d1b338e04c.exe windows:4 windows x86 arch:x86
606250c95f94d1ba9a4631a91ed385c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetStdHandle
GetConsoleMode
TlsGetValue
GetLastError
SetLastError
RaiseException
ExitProcess
GetStartupInfoA
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
GetSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
FormatMessageW
DeleteFileW
CreateFileW
GetFileAttributesW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
GetCurrentThread
OpenThread
IsDebuggerPresent
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
RtlUnwind
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
GetEnvironmentStringsA
FreeEnvironmentStringsA
GetWindowsDirectoryA
GetVersionExA
CompareStringA
GetLocaleInfoA
GetDateFormatA
EnumCalendarInfoA
GetModuleFileNameW
GetCommandLineW
FindNextFileW
CompareStringW
GetLocaleInfoW
GetDateFormatW
FindFirstFileExW
VirtualFree
GetExitCodeThread
DeviceIoControl
FindClose
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FileTimeToDosDateTime
GetCPInfo
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArrayUnaccessData
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
PeekMessageA
CharToOemA
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
MsgWaitForMultipleObjects
GetSystemMetrics
MessageBeep
ole32
CoCreateGuid
advapi32
OpenEventLogA
ReportEventA
RegCreateKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
RegSetValueExA
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
CloseEventLog
RegCloseKey
RegFlushKey
ws2_32
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockopt
listen
recv
select
send
socket
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
wsock32
gethostbyaddr
gethostbyname
WSAStartup
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE