Static task
static1
Behavioral task
behavioral1
Sample
670808aea78367d5631f4ad59d9c89d3097048378177b70e0238ece40e88a915.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
670808aea78367d5631f4ad59d9c89d3097048378177b70e0238ece40e88a915.exe
Resource
win10v2004-20231215-en
General
-
Target
670808aea78367d5631f4ad59d9c89d3097048378177b70e0238ece40e88a915
-
Size
743KB
-
MD5
02220e4ce3da8797560f2e128b6d84d4
-
SHA1
1698e5eddbbd3153ab744cd29e025e980206b554
-
SHA256
670808aea78367d5631f4ad59d9c89d3097048378177b70e0238ece40e88a915
-
SHA512
1dd98ce38be154368da747a257347bd26b9d5018cd0fe359d3d428b4b75c61af0b3c990e6aefd92688761cd82a6963335aaee3719e7de6507b4c1b6e83704d68
-
SSDEEP
12288:LD5iy4Ii5IMPtB3slZo0chrHsT7J/cSX+Qx1KuY23bE62Uh6j8prapjvV:Riyi5IMttsZDchroBctoRE62Uh6Ihejt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 670808aea78367d5631f4ad59d9c89d3097048378177b70e0238ece40e88a915
Files
-
670808aea78367d5631f4ad59d9c89d3097048378177b70e0238ece40e88a915.exe windows:5 windows x64 arch:x64
43abd757e2af547c27f3aa862031733e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetConsoleCtrlHandler
GetCurrentProcess
DeviceIoControl
FindClose
SetFileTime
CloseHandle
BackupRead
BackupSeek
RemoveDirectoryW
CreateFileW
DeleteFileW
FindFirstFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetFileTime
GetCurrentProcessId
GetDriveTypeW
GetDiskFreeSpaceExW
CreateDirectoryW
SetFileAttributesW
GetFileAttributesW
GetVolumeInformationW
FindNextFileW
GetVersionExW
GetModuleFileNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
SetErrorMode
FreeLibrary
LoadLibraryExW
ExpandEnvironmentStringsW
CompareStringA
GetLocaleInfoW
FormatMessageW
SetThreadPriority
SetThreadExecutionState
CreateEventW
LoadLibraryW
GetSystemDirectoryW
SetPriorityClass
GetProcessAffinityMask
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
HeapSize
SetFilePointerEx
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
Sleep
GetLastError
LocalFree
WriteConsoleW
ReadConsoleW
SetConsoleMode
GetConsoleMode
WriteFile
GetStdHandle
GetFileType
GetCommandLineW
GetModuleHandleW
GetProcAddress
GetFileInformationByHandle
GetCurrentThread
SetLastError
FindFirstFileExA
HeapReAlloc
SetStdHandle
GetConsoleCP
LCMapStringW
GetStringTypeW
HeapAlloc
HeapFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameA
GetCommandLineA
GetACP
user32
ExitWindowsEx
LoadStringW
CharLowerW
CharToOemBuffW
CharToOemBuffA
OemToCharBuffA
OemToCharA
CharToOemA
CharUpperW
OemToCharBuffW
MessageBeep
advapi32
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
GetSecurityDescriptorLength
AdjustTokenPrivileges
OpenProcessToken
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
shell32
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHFileOperationW
ole32
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantClear
SysFreeString
SysAllocString
powrprof
SetSuspendState
Sections
.text Size: 570KB - Virtual size: 570KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ