Static task
static1
Behavioral task
behavioral1
Sample
1825ade5606e8564e93afb8ceb9b4484b292055290e706bd92ce734c194b4cf9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1825ade5606e8564e93afb8ceb9b4484b292055290e706bd92ce734c194b4cf9.exe
Resource
win10v2004-20231215-en
General
-
Target
1825ade5606e8564e93afb8ceb9b4484b292055290e706bd92ce734c194b4cf9
-
Size
514KB
-
MD5
eb6c7e00cc694615a681a3df7906aea2
-
SHA1
874ff162dc91647afcaa20068039602d97ea56dc
-
SHA256
1825ade5606e8564e93afb8ceb9b4484b292055290e706bd92ce734c194b4cf9
-
SHA512
ffc695593da4726a421983f6c1e16bfdeb105c5c8fd0ac91444dc7b943ece65175d4545ad7bdf63806a8b9299b3ed7b0e22cfc08ca2a1eed806c436acd7b0bc0
-
SSDEEP
12288:y1A/A6EnmhdCFXBPQm9uY3wZ3r5Ndel7ovo8kLYzRGVBSgKl/:y+Ruj3wZ3trIEvzzRk8x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1825ade5606e8564e93afb8ceb9b4484b292055290e706bd92ce734c194b4cf9
Files
-
1825ade5606e8564e93afb8ceb9b4484b292055290e706bd92ce734c194b4cf9.exe windows:6 windows x86 arch:x86
3be64cc74f51a2e48addd96edd85a29d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
SetConsoleTitleA
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
WriteConsoleW
CreateFileW
HeapSize
ReadConsoleW
ReadFile
GetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
SetConsoleTextAttribute
CreateThread
CloseHandle
SetStdHandle
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapReAlloc
SetEndOfFile
sqlite3
sqlite3_column_text
sqlite3_errmsg
sqlite3_column_int
sqlite3_column_blob
sqlite3_bind_int
sqlite3_reset
sqlite3_exec
sqlite3_close
sqlite3_prepare_v2
sqlite3_open_v2
sqlite3_bind_text
sqlite3_initialize
sqlite3_bind_blob
sqlite3_finalize
sqlite3_shutdown
sqlite3_config
sqlite3_step
ws2_32
ntohs
htonl
htons
ntohl
inet_addr
hpsocket
HP_Create_UdpNode
HP_Create_TcpServer
HP_Destroy_TcpServer
HP_Destroy_UdpNode
Sections
.text Size: 395KB - Virtual size: 394KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE