Static task
static1
Behavioral task
behavioral1
Sample
490d32f052a09a1b7260f1d4ea87bc15.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
490d32f052a09a1b7260f1d4ea87bc15.exe
Resource
win10v2004-20231222-en
General
-
Target
490d32f052a09a1b7260f1d4ea87bc15.exe
-
Size
13.7MB
-
MD5
490d32f052a09a1b7260f1d4ea87bc15
-
SHA1
7b672cba886eba0da50f056947f18ea64013a98b
-
SHA256
91837a43452e06bdd26cb292adae96229cd6979db9ee8300323581d02c2c8bbb
-
SHA512
b37f1d7b71f2d719c1ace5b6fa2bf0b7eaaa8864ab86ca28cc9a41b55864df76941f5ad47dcaaf804b8f7194f07de03aaaea2abe2971bd10fbd9a9b7fdebbac4
-
SSDEEP
3072:sLEJr/5lrI8TSdx8IERqbb2ZREmtoXvtRwjjjjjjjjjjjjjjjjjjjjjjjjjjjjjX:sLEJ/55I8+dWIuRh8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 490d32f052a09a1b7260f1d4ea87bc15.exe
Files
-
490d32f052a09a1b7260f1d4ea87bc15.exe.exe windows:5 windows x86 arch:x86
3504f3b9f09811d9cc7b46e5e08c6ac9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetComputerNameA
CreateMutexW
SearchPathW
OpenFile
TlsGetValue
LocalCompact
LoadResource
ReadConsoleA
InterlockedDecrement
ScrollConsoleScreenBufferW
SetDefaultCommConfigW
WaitForSingleObject
_lclose
SetTapeParameters
CreateNamedPipeW
GetProcessHeap
GetSystemTimeAsFileTime
FindActCtxSectionStringA
SetProcessPriorityBoost
ActivateActCtx
FindResourceExA
LoadLibraryW
LocalShrink
GetPrivateProfileStructW
SetSystemTimeAdjustment
SetConsoleMode
GetFileAttributesW
IsDBCSLeadByte
ReadFile
lstrcatA
CompareStringW
GetACP
lstrlenW
DisconnectNamedPipe
GetPrivateProfileIntW
ReleaseActCtx
GetLastError
GetProcAddress
GetTapeStatus
BeginUpdateResourceW
GetConsoleDisplayMode
VirtualProtectEx
GetLocalTime
LocalAlloc
BuildCommDCBAndTimeoutsW
AddAtomW
GetProfileStringA
VirtualLock
WaitCommEvent
ContinueDebugEvent
FreeEnvironmentStringsW
WriteProfileStringW
GetConsoleCursorInfo
OpenSemaphoreW
GetVersionExA
GetSystemTime
SuspendThread
lstrcpyW
CopyFileExA
GetModuleHandleA
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
RaiseException
user32
GetCursorPos
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 737KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.5MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ