Static task
static1
Behavioral task
behavioral1
Sample
97ac65dd9fe5d5a6d4e37aa8754627f66eb77a7df51e4febe43ad270b52af561.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97ac65dd9fe5d5a6d4e37aa8754627f66eb77a7df51e4febe43ad270b52af561.exe
Resource
win10v2004-20231215-en
General
-
Target
97ac65dd9fe5d5a6d4e37aa8754627f66eb77a7df51e4febe43ad270b52af561
-
Size
1.4MB
-
MD5
ccb7ce4e702ce73546b7a9a34acd315e
-
SHA1
2135c17c6de26644f809e06f3887cd8ceca3687f
-
SHA256
97ac65dd9fe5d5a6d4e37aa8754627f66eb77a7df51e4febe43ad270b52af561
-
SHA512
bae04be14bb509d255e4a1bfe6ad0f6e317d12efd284cb5d0b4e6591be5c710e5e3806bbe007cb0f9205aaa8cd36003534b807b518554d44e8897a7189062d49
-
SSDEEP
12288:zrGIYairbgjHpzFnzVwFOe0DFDQk47T0z7hX/R5+wDl2HpNdBGavU9xJgF7M3p:OIFFVzFmAeUH/hiql0pYas9xB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97ac65dd9fe5d5a6d4e37aa8754627f66eb77a7df51e4febe43ad270b52af561
Files
-
97ac65dd9fe5d5a6d4e37aa8754627f66eb77a7df51e4febe43ad270b52af561.exe windows:5 windows x64 arch:x64
a0c950a30e11aeefbeec62710dc9d4ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws_log
ord50
ord2
comsupport
ord1
cvaliablevtslist
GetValiableTitleListInVTS
CreateVTSAnalysis
DestroyVTSAnalysis
SetAnalysisFold
GetValiableVTSListEx
ws_mutfileinfo
IsDRMFile
GetWTMMediaInfo
kernel32
ReadConsoleW
ReadFile
SetEndOfFile
WideCharToMultiByte
GetCurrentProcessId
lstrlenW
FindFirstFileW
FindClose
FindNextFileW
GetVolumeInformationW
GetCommandLineW
LocalFree
CreateToolhelp32Snapshot
Process32NextW
LCMapStringW
HeapReAlloc
OutputDebugStringW
LoadLibraryExW
GetStringTypeW
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
Process32FirstW
LeaveCriticalSection
QueryPerformanceCounter
DeleteCriticalSection
CreateFileW
GetFileType
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
EncodePointer
DecodePointer
GetLastError
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
EnterCriticalSection
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
GetStdHandle
GetModuleFileNameW
GetProcessHeap
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
user32
LoadAcceleratorsW
LoadStringW
SendMessageW
PostMessageW
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcW
UpdateWindow
ShowWindow
SetTimer
CreateWindowExW
DestroyWindow
RegisterClassExW
LoadCursorW
LoadIconW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
gdi32
DeleteObject
shell32
CommandLineToArgvW
ole32
CoUninitialize
CoInitialize
CoCreateGuid
rpcrt4
UuidToStringW
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE