Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231222-en
General
-
Target
tmp
-
Size
550KB
-
MD5
dada573395c1c884e6ac95903dddd248
-
SHA1
d7b86df8527814ebeb8888405550d4067b1f7af0
-
SHA256
a96eb2506b1e27a7b7b7268152843555654909316ec2a291aa474faa8cf5acdf
-
SHA512
a3b0589cee27a1ad120b89724eca6493c2c0d81c72e7c4987509e2fcf452da812b9c2f20b1fa44a77bd612550022f6c2ac83aa8dd1f3e7867eb1deb70bf21ef3
-
SSDEEP
12288:RXGka400slovzbACAnUHc5G718Lb4oTdbHBGjj4FxlnUtql:RGkaAZ3ACAUvYdbhGPUxlnXl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows:4 windows x86 arch:x86
4ab589c7f752c02d293f6dd6b33942f6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVolumeInformationA
LeaveCriticalSection
lstrcmpiA
EnterCriticalSection
lstrlenA
GetVersion
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEndOfFile
SetFilePointer
SetFileTime
GetDriveTypeA
GetConsoleScreenBufferInfo
GetStdHandle
ReadFile
SetConsoleMode
GetConsoleMode
DosDateTimeToFileTime
SetFileAttributesA
GetFileAttributesA
GetFileTime
SetVolumeLabelA
GetCurrentDirectoryA
SetEnvironmentVariableW
CreateDirectoryA
lstrcpynA
CreateMutexA
InterlockedExchange
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
GetCurrentProcess
CreateFileA
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetFullPathNameA
CloseHandle
MultiByteToWideChar
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
SetStdHandle
GetFileType
HeapReAlloc
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStartupInfoA
GetACP
GetOEMCP
GetCPInfo
WriteFile
FlushFileBuffers
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSize
VirtualProtect
GetSystemInfo
VirtualQuery
GetExitCodeProcess
CreateProcessA
CompareStringA
CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
RtlUnwind
GetLocaleInfoW
DeleteFileA
FindClose
FindFirstFileA
user32
CharToOemA
OemToCharA
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE