Static task
static1
Behavioral task
behavioral1
Sample
a3ff3bc8a683c604b3c7b0b21800c0f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a3ff3bc8a683c604b3c7b0b21800c0f5.exe
Resource
win10v2004-20231222-en
General
-
Target
a3ff3bc8a683c604b3c7b0b21800c0f5.exe
-
Size
73KB
-
MD5
a3ff3bc8a683c604b3c7b0b21800c0f5
-
SHA1
93c671b9458aff7958f3c42d8334cc144fc37503
-
SHA256
c64bb2160f579f3d55ad85880ca2d017665cc8716fd4685cdb6b32cc471e0b72
-
SHA512
ce652c0c4dabfa1d169f93706383a1f118185edce7db0703991f8a6cdfcc8bc03279792cfab1833ca02bb1fa511555f33c05b727dbe84129a97853905e0ecd90
-
SSDEEP
768:gk/9KHCK+91uYYC2rwVST9WnETQX3t14xG2nJpiDy0SGZ50Do:gk/wK9kes2YQX3nenJpqrSqYo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3ff3bc8a683c604b3c7b0b21800c0f5.exe
Files
-
a3ff3bc8a683c604b3c7b0b21800c0f5.exe.exe windows:4 windows x86 arch:x86
80285922a709b3bae30f004a298d2022
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryExW
DeviceIoControl
LoadLibraryA
VirtualProtect
VirtualProtectEx
CreateProcessW
ReadFile
Sleep
LoadLibraryExA
ReadFile
GetSystemTime
DeviceIoControl
GetSystemTime
CreateProcessA
Sleep
DeviceIoControl
Sleep
GetSystemTimeAsFileTime
GetStartupInfoA
VirtualProtect
CreateProcessW
LoadLibraryExW
GetSystemTime
Sleep
LoadLibraryExA
ReadProcessMemory
TerminateProcess
ReadFile
GetStartupInfoW
ReadFile
WaitForSingleObjectEx
GetProcAddress
FindFirstChangeNotificationW
GetLastError
LoadLibraryA
GetCurrentProcessId
SetEvent
ReadProcessMemory
SleepEx
CreateProcessW
CreateProcessA
LoadLibraryA
WriteProcessMemory
DeviceIoControl
GetSystemTimeAsFileTime
LoadLibraryA
CreateProcessA
WaitForSingleObject
WaitForSingleObjectEx
CreateProcessW
WaitForSingleObject
CreateProcessW
Sleep
LoadLibraryExW
GetStartupInfoA
GetStartupInfoA
CreateFileA
DeviceIoControl
CreateFileA
WaitForSingleObject
WriteProcessMemory
LoadLibraryExA
CreateProcessA
GetStartupInfoA
GetSystemTime
GetStartupInfoW
TerminateProcess
GetStartupInfoA
VirtualProtectEx
SleepEx
ReleaseMutex
GetSystemTimeAsFileTime
Sleep
WriteProcessMemory
LoadLibraryA
GetStartupInfoW
ReadFile
GetStartupInfoW
WriteProcessMemory
LoadLibraryExW
CreateProcessA
GetStartupInfoA
GetStartupInfoA
VirtualProtect
VirtualProtect
ReleaseMutex
LoadLibraryExW
LoadLibraryA
GetSystemTime
Sleep
WaitForSingleObject
ReadProcessMemory
GetSystemTimeAsFileTime
VirtualProtectEx
VirtualProtect
ReadFile
WriteProcessMemory
GetStartupInfoW
VirtualProtect
CreateProcessA
GetStartupInfoA
ReadProcessMemory
GetStartupInfoA
TerminateProcess
WaitForSingleObject
ReadProcessMemory
CreateFileA
GetStartupInfoA
CreateProcessW
LoadLibraryA
LoadLibraryExW
GetStartupInfoA
SleepEx
GetStartupInfoA
WaitForSingleObjectEx
ReadProcessMemory
GetSystemTime
ReadProcessMemory
SleepEx
LoadLibraryExW
CreateProcessA
LoadLibraryExW
GetSystemTimeAsFileTime
ReadProcessMemory
DeviceIoControl
WaitForSingleObjectEx
CreateProcessA
SleepEx
CreateProcessW
Sleep
LoadLibraryA
LoadLibraryExW
DeviceIoControl
DeviceIoControl
TerminateProcess
LoadLibraryExA
LoadLibraryExA
VirtualProtect
VirtualProtect
Sleep
WaitForSingleObject
ReadProcessMemory
LoadLibraryA
ReleaseMutex
VirtualProtect
LoadLibraryA
LoadLibraryA
GetStartupInfoW
SleepEx
WaitForSingleObject
LoadLibraryExA
LoadLibraryExA
WaitForSingleObjectEx
TerminateProcess
CreateProcessW
LoadLibraryA
WaitForSingleObject
LoadLibraryA
VirtualProtect
ReleaseMutex
ReadProcessMemory
Sleep
VirtualProtect
Sleep
DeviceIoControl
LoadLibraryExW
LoadLibraryExW
Sleep
WaitForSingleObjectEx
GetSystemTime
SleepEx
DeviceIoControl
VirtualProtectEx
ReadProcessMemory
WaitForSingleObjectEx
VirtualProtect
GetSystemTimeAsFileTime
SleepEx
ReadFile
GetStartupInfoW
LoadLibraryA
CreateProcessA
LoadLibraryA
GetSystemTime
ReleaseMutex
LoadLibraryA
CreateFileA
WriteProcessMemory
Sections
.text Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 44KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE