Static task
static1
Behavioral task
behavioral1
Sample
4e9bb283a0108566dc2e863fe7d6095a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e9bb283a0108566dc2e863fe7d6095a.exe
Resource
win10v2004-20231215-en
General
-
Target
4e9bb283a0108566dc2e863fe7d6095a.exe
-
Size
253KB
-
MD5
4e9bb283a0108566dc2e863fe7d6095a
-
SHA1
89b2875664ce0607a9c54c3d4027a60b9e63a729
-
SHA256
990f82567dd8de4a18993d002c0711465e3af88da93dd37abd23ffd8631d8148
-
SHA512
aa38135e818a51de975a6828b9ef69c79bafe998a5a3cf6d4e0d9ebec07f94f7b0c7e372ddde2266d123fcb6a8aefe2eb08ce6201e341eb889b811634cf817b7
-
SSDEEP
6144:hoMazGcbeLHWkd/1t8MUZ0qQgIX800Z6H3UMAj:SxzXeLHW8/1t8F0q+8vMW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e9bb283a0108566dc2e863fe7d6095a.exe
Files
-
4e9bb283a0108566dc2e863fe7d6095a.exe.exe windows:4 windows x86 arch:x86
f87708d68dbfafb9e7f6cd7a710430dc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
MultiByteToWideChar
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
lstrcmpA
GetProcAddress
LoadLibraryA
advapi32
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
query
CIState
LoadIFilter
DllUnregisterServer
CiSvcMain
LocateCatalogsW
BeginCacheTransaction
CITextToFullTree
mscat32
CryptCATEnumerateAttr
DllRegisterServer
CryptCATPutAttrInfo
CryptCATStoreFromHandle
CryptCATOpen
CryptCATVerifyMember
Sections
.icode Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 88KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 125KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ