Static task
static1
Behavioral task
behavioral1
Sample
0ad6f562fe61135b2776e8a1a36f3d8014fd1e50220e07e1478d7ddaa9143a04.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ad6f562fe61135b2776e8a1a36f3d8014fd1e50220e07e1478d7ddaa9143a04.exe
Resource
win10v2004-20231215-en
General
-
Target
0ad6f562fe61135b2776e8a1a36f3d8014fd1e50220e07e1478d7ddaa9143a04
-
Size
10.0MB
-
MD5
7ab898e6efd7da53d5fc33614ad058ed
-
SHA1
88847d3020a5b63e458204fe2c2c7350453caa5e
-
SHA256
0ad6f562fe61135b2776e8a1a36f3d8014fd1e50220e07e1478d7ddaa9143a04
-
SHA512
ac57b8e6877d66e0fd9b0073d780f7d7c4cba6f1c2b916a3b60d2111d1063dbf276cef814671a8d04670ba73698b25492d48732c9f9f5ab599dcfa5347ea78ec
-
SSDEEP
196608:b7g/SxMTq8DkOvhErA/tWThA8BR/YQeGHzc0T9n7ADGXAURZIe:TeJDkgE/ThA8L/Y3GTnn8MZf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ad6f562fe61135b2776e8a1a36f3d8014fd1e50220e07e1478d7ddaa9143a04
Files
-
0ad6f562fe61135b2776e8a1a36f3d8014fd1e50220e07e1478d7ddaa9143a04.exe windows:6 windows x64 arch:x64
1eec59e0882518e35371584fd628cd80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
SysAllocStringLen
VariantClear
SysStringLen
user32
GetParent
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
CopyRect
GetWindowRect
LoadIconW
DialogBoxParamW
SendMessageW
SetWindowPos
LoadStringW
CharUpperW
SetWindowTextW
EndDialog
ShowWindow
DestroyWindow
PostMessageW
MessageBoxW
SetTimer
KillTimer
GetDlgItem
shell32
ShellExecuteExW
CommandLineToArgvW
kernel32
FindClose
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetFileType
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetCommandLineW
ExpandEnvironmentStringsW
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
lstrlenW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
FormatMessageW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemDirectoryW
GetModuleHandleW
GetProcAddress
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetModuleHandleA
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetCurrentProcess
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
GetStdHandle
GetFileInformationByHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
GetVersionExW
lstrcatW
InitializeCriticalSection
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlPcToFileHeader
RtlUnwindEx
Sections
.text Size: 194KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ