Static task
static1
Behavioral task
behavioral1
Sample
2a512e317b8dc2f6b8c5a86d2642065d5be934d67125a7396bc7d38596c29cd7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2a512e317b8dc2f6b8c5a86d2642065d5be934d67125a7396bc7d38596c29cd7.exe
Resource
win10v2004-20231215-en
General
-
Target
2a512e317b8dc2f6b8c5a86d2642065d5be934d67125a7396bc7d38596c29cd7
-
Size
8.0MB
-
MD5
065f09d23183993ef8542cbadfc407b9
-
SHA1
22f2243074d935c1aff4c65c437a7e34746bee0a
-
SHA256
2a512e317b8dc2f6b8c5a86d2642065d5be934d67125a7396bc7d38596c29cd7
-
SHA512
242aff40368445b1c9e8cbebda72a1d3545f9a71d2ccdf45117c2023881e16a840390063514cf99bd038be9ecc3e11bb07b30c2b71245923bc375c06b9d09616
-
SSDEEP
196608:qGlJwUCd/mAYgtzFF8YWxeebTXnEMP2T:XHwacFaeeXEg2T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a512e317b8dc2f6b8c5a86d2642065d5be934d67125a7396bc7d38596c29cd7
Files
-
2a512e317b8dc2f6b8c5a86d2642065d5be934d67125a7396bc7d38596c29cd7.exe windows:5 windows x64 arch:x64
d2180032be79f897fd12e1dfd634e58d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
psapi
GetModuleInformation
GetMappedFileNameW
GetModuleFileNameExW
userenv
ExpandEnvironmentStringsForUserW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shlwapi
PathRemoveFileSpecW
PathFindFileNameA
PathFileExistsW
StrStrIW
PathFindFileNameW
PathAppendW
wtsapi32
WTSQueryUserToken
ws2_32
WSAStartup
htonl
htons
freeaddrinfo
inet_addr
getaddrinfo
select
__WSAFDIsSet
WSACleanup
getsockname
getsockopt
WSAGetLastError
accept
bind
listen
setsockopt
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
ioctlsocket
sendto
recv
recvfrom
connect
socket
send
WSAAddressToStringA
closesocket
gethostname
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
getpeername
WSAIoctl
ntohs
WSAStringToAddressA
WSASetLastError
wldap32
ord301
ord79
ord30
ord200
ord22
ord41
ord143
ord217
ord46
ord26
ord27
ord32
ord35
ord33
ord60
ord50
ord211
kernel32
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
DuplicateHandle
EncodePointer
GetCPInfo
OutputDebugStringW
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
GetFileAttributesExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetConsoleCP
IsValidLocale
FlushFileBuffers
GetCurrentDirectoryW
GetFullPathNameW
GetFullPathNameA
SetStdHandle
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
CreateFileW
GetFileAttributesW
AreFileApisANSI
CloseHandle
RaiseException
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexA
CreateMutexW
CreateEventW
Sleep
GetProcessTimes
TerminateProcess
GetThreadTimes
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetLogicalProcessorInformation
VirtualAlloc
VirtualProtect
VirtualFree
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
MapViewOfFileEx
UnmapViewOfFile
CreateTimerQueueTimer
DeleteTimerQueueTimer
InterlockedPopEntrySList
GetModuleFileNameW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
SetThreadAffinityMask
CreateFileMappingA
RegisterWaitForSingleObject
UnregisterWait
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLCID
EnumSystemLocalesW
GetEnvironmentVariableW
GetEnvironmentVariableA
ResumeThread
OpenProcess
ExitProcess
GetCurrentProcess
GetCurrentThreadId
SuspendThread
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
WriteFile
SetFilePointer
GetFileSize
GetModuleHandleW
HeapSize
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
SwitchToThread
GetCurrentProcessId
SizeofResource
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryA
GetLogicalDriveStringsA
GetTempPathW
GetTempFileNameW
CreateThread
OpenEventW
SetCurrentDirectoryW
SystemTimeToFileTime
GetSystemTime
TryEnterCriticalSection
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetUserDefaultUILanguage
Thread32Next
InitializeCriticalSection
OpenThread
CreateDirectoryW
GetModuleHandleExW
ExpandEnvironmentStringsW
DeleteFileW
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
ReadFile
GetFileSizeEx
EnumResourceNamesW
SetFilePointerEx
GetFileTime
TerminateThread
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetProcessId
GlobalAlloc
GlobalFree
GetModuleFileNameA
Module32FirstW
Module32NextW
SetUnhandledExceptionFilter
GetCommandLineA
UnhandledExceptionFilter
OpenMutexW
GetModuleHandleA
LoadLibraryA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
GetStdHandle
OutputDebugStringA
DeleteFiber
FindFirstFileA
FindNextFileA
FormatMessageA
ConvertFiberToThread
QueryPerformanceCounter
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
IsBadCodePtr
GetExitCodeThread
GetVersionExA
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FormatMessageW
MoveFileExA
PeekNamedPipe
WaitForMultipleObjects
QueryDepthSList
UnregisterWaitEx
HeapCreate
GetDiskFreeSpaceW
LockFile
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
FreeLibrary
Thread32First
user32
GetClassNameW
EnumChildWindows
IsWindowEnabled
GetAncestor
GetWindowThreadProcessId
GetWindowInfo
SendMessageTimeoutW
GetWindow
GetWindowLongW
LookupIconIdFromDirectory
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
UpdateWindow
TranslateMessage
DispatchMessageW
GetMessageW
DefWindowProcW
SetWindowLongPtrW
CreateWindowExW
GetWindowLongPtrW
GetDesktopWindow
GetLayeredWindowAttributes
IsWindow
IsWindowVisible
RegisterClassExW
advapi32
DeleteService
RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
FreeSid
CryptEncrypt
OpenProcessToken
SetEntriesInAclW
AllocateAndInitializeSid
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
ChangeServiceConfigW
ControlService
OpenSCManagerW
CloseServiceHandle
OpenEventLogW
ReadEventLogW
CloseEventLog
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
shell32
CommandLineToArgvW
pdh
PdhCloseQuery
PdhAddCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryW
dbghelp
MiniDumpWriteDump
Sections
.text Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 156KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ