Static task
static1
Behavioral task
behavioral1
Sample
41fef26a7bbdf8b04d947cf3f678cd55.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
41fef26a7bbdf8b04d947cf3f678cd55.exe
Resource
win10v2004-20231215-en
General
-
Target
41fef26a7bbdf8b04d947cf3f678cd55
-
Size
131KB
-
MD5
41fef26a7bbdf8b04d947cf3f678cd55
-
SHA1
4857a97a9c782bccf9a7ed0d5e3d9152fb675e7c
-
SHA256
3169366b895bff50c3a6b454fe1f4910ac1c6ea6221aa41bbe8f72ba441151fc
-
SHA512
17850db2ac2b790a539cb72c7cdf8d8d18a236bddbfcbf78d687e3c6ec7bcd1cdbe7d161c98de30511951719c578c4147f511e1e477f381cb9d853e1a3304bb7
-
SSDEEP
3072:kuyikoIhIFqiRqG3fdqQizExCzFLxHaSFnq3MHzq5X:dszEIznqD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41fef26a7bbdf8b04d947cf3f678cd55
Files
-
41fef26a7bbdf8b04d947cf3f678cd55.exe windows:5 windows x86 arch:x86
740f5d5b01bbfbe455bc732b84a719f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
wvnsprintfA
StrRChrA
StrCmpNIA
imagehlp
CheckSumMappedFile
psapi
GetProcessImageFileNameA
kernel32
OpenProcess
GetTempFileNameA
GetTempPathA
GetProcAddress
GetModuleHandleA
GlobalAlloc
LoadLibraryExA
GlobalFree
FreeLibrary
CreateFileA
GetProcessHeap
HeapAlloc
DeviceIoControl
HeapFree
CloseHandle
lstrcpyA
CreatePipe
CreateProcessA
WaitForSingleObject
DeleteFileA
MoveFileExA
WideCharToMultiByte
lstrlenA
lstrcpynA
GetCurrentProcess
GetPrivateProfileStringA
GetVersionExA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetPrivateProfileIntA
CreateDirectoryA
GetFileAttributesA
CopyFileA
MoveFileA
Sleep
lstrcatA
GetFileTime
SetFileTime
WriteFile
GetFileSize
SetFilePointer
lstrcmpiA
WritePrivateProfileStringA
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyA
shell32
SHGetSpecialFolderPathA
CommandLineToArgvW
ole32
CoCreateGuid
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE