Static task
static1
Behavioral task
behavioral1
Sample
49816d2916045850bb8e6970cb03c30f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
49816d2916045850bb8e6970cb03c30f.exe
Resource
win10v2004-20231222-en
General
-
Target
49816d2916045850bb8e6970cb03c30f
-
Size
865KB
-
MD5
49816d2916045850bb8e6970cb03c30f
-
SHA1
f4344e17ad9123fbcd5fced7916b8c6fe31c6367
-
SHA256
763c081c38fc8460d6e28fc34cf33810101d5a65dda9b8e3dad6fc6721add181
-
SHA512
e101588811f50108dbdc70e2db94254289608b768d6f87ab9d3d5a26556bd1dfa3e44b46c902b9b0917fc3a6aa3ce38ed4852920bc0a9e628e840915bb0cfea4
-
SSDEEP
12288:+YpFb6mLuq20sgVRtPVpaGJlwu0EaCjyFCPC5GrOTRfS:+YX6Uu2s+pH8OaTC6TZS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49816d2916045850bb8e6970cb03c30f
Files
-
49816d2916045850bb8e6970cb03c30f.exe windows:4 windows x86 arch:x86
a1352e1786f3f3669b120e2e42ac0e16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
lstrlenA
lstrcatA
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
GetLastError
LCMapStringW
GetCPInfo
HeapAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TlsAlloc
SetLastError
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
WriteFile
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetFilePointer
CloseHandle
ReadFile
TerminateProcess
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
HeapSize
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
SetStdHandle
CreateFileA
GetLocaleInfoW
SetEndOfFile
user32
wsprintfA
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ