Static task
static1
Behavioral task
behavioral1
Sample
4fb0c973508a4a05a423b66d272f094f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4fb0c973508a4a05a423b66d272f094f.exe
Resource
win10v2004-20231215-en
General
-
Target
4fb0c973508a4a05a423b66d272f094f
-
Size
70KB
-
MD5
4fb0c973508a4a05a423b66d272f094f
-
SHA1
e2a387cdaf599101ca8c40028831a4455d48498f
-
SHA256
27949f3d7ba3ef68449097569ccb57014d00e16bfbb04814c9d669e95f3949a0
-
SHA512
7db67ebf0b4458388141183e9c524c10ac342e947db8c7a6f57e766b6a5e2a71214be3859299fc5640b418842c833b1f768b59d383ec964cf962e61e695c21dc
-
SSDEEP
1536:H+QWvZhSRqln5IUmDjoXV3usrhiADmHNavlJkLdm:TWvZ0Rqln5IOnINaLk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4fb0c973508a4a05a423b66d272f094f
Files
-
4fb0c973508a4a05a423b66d272f094f.exe windows:6 windows x86 arch:x86
ef8a44fe2f9ad4ab85e55004aaa024a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapSetInformation
QueryActCtxW
CloseHandle
SetFilePointer
ReadFile
CreateFileW
LocalFree
lstrlenA
WideCharToMultiByte
LocalAlloc
lstrlenW
GetProcAddress
WaitForSingleObject
CreateProcessW
GetCommandLineW
Wow64EnableWow64FsRedirection
GetSystemDirectoryW
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
SetProcessDEPPolicy
FormatMessageW
GetLastError
LoadLibraryExW
FreeLibrary
ExitProcess
SetErrorMode
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
Sleep
GetStartupInfoW
InterlockedExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
CompareStringW
ReleaseActCtx
DeactivateActCtx
GetFileAttributesW
SearchPathW
CreateActCtxW
GetModuleHandleW
ActivateActCtx
user32
LoadIconW
CharNextW
DefWindowProcW
GetClassLongW
GetClassNameW
GetWindow
GetWindowLongW
SetWindowLongW
SetClassLongW
CreateWindowExW
RegisterClassW
LoadCursorW
LoadStringW
MessageBoxW
DestroyWindow
msvcrt
iswalpha
_wtoi
wcschr
__wgetmainargs
memset
_vsnwprintf
__set_app_type
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
imagehlp
ImageDirectoryEntryToData
ntdll
NtClose
NtOpenProcessToken
NtSetInformationToken
RtlImageNtHeader
NtSetInformationProcess
NtQueryInformationToken
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE