Static task
static1
Behavioral task
behavioral1
Sample
3f809828b731e72e335651087857bfc4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3f809828b731e72e335651087857bfc4.exe
Resource
win10v2004-20231222-en
General
-
Target
3f809828b731e72e335651087857bfc4
-
Size
249KB
-
MD5
3f809828b731e72e335651087857bfc4
-
SHA1
c3a21dd451209cd4bdf0a469c855da3c72bddddf
-
SHA256
5277a411960f8073f9640aee807b9efa741d61eaa71f7586223bd9f3737cf323
-
SHA512
c1f17bfcf0aa52478b555b20e881e5eedb202bb6dc1c00ffb57d102d70bd19f2d3d020fb7666b5e5f3d073629ea1a17bbbd1f67bb35f32fb7619083598ad7028
-
SSDEEP
6144:YaXzmyhQkUL9l7O2sO51lH2eCA/KfOpaYa:fzrhQkUBl7O2sO511YcKr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f809828b731e72e335651087857bfc4
Files
-
3f809828b731e72e335651087857bfc4.exe windows:4 windows x86 arch:x86
920adaf701b2b1b5b9c4460954a5e182
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyW
GetModuleHandleA
LockResource
LoadResource
FindResourceExA
SetFilePointer
CreateFileA
CreateFileW
ReadFile
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetFullPathNameA
GetFullPathNameW
IsDBCSLeadByteEx
IsValidCodePage
FreeLibrary
GetSystemTimeAsFileTime
CloseHandle
CreateEventW
DeleteCriticalSection
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetLocalTime
VirtualAlloc
user32
MessageBoxA
advapi32
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
query
FsCiShutdown
LoadIFilter
CIRestrictionToFullTree
CollectCIPerformanceData
CIMakeICommand
mapistub
BMAPIResolveName
DllGetClassObject
GetTnefStreamCodepage
cmc_list
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.q Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Pq Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yKR Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BqEEa Size: 512B - Virtual size: 575B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.YcfIL Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yqzKd Size: 1024B - Virtual size: 1006B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 213KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uzSCBc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.odP Size: 512B - Virtual size: 370B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ