Static task
static1
Behavioral task
behavioral1
Sample
e96e988d061758a49d60b1240dc7fac645c42e698231ce85aac89eb23facd866exe.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e96e988d061758a49d60b1240dc7fac645c42e698231ce85aac89eb23facd866exe.exe
Resource
win10v2004-20231215-en
General
-
Target
e96e988d061758a49d60b1240dc7fac645c42e698231ce85aac89eb23facd866exe.exe
-
Size
16.8MB
-
MD5
d01913e03a48bf0b1e1016df05ac9d08
-
SHA1
e9b6f24ae3da594e1651fa271183d053fe901df9
-
SHA256
e96e988d061758a49d60b1240dc7fac645c42e698231ce85aac89eb23facd866
-
SHA512
87a9054e7608d8e98ca4103e656e48ff51156d4d6b2e910c7955afd9fcf423071c4878f9e17f9cc69e16a7fe8daed68088ffe698a52c6dc9059d13a85730bc6d
-
SSDEEP
393216:fqYj68rkO2LExATfcrKR9p7/nL7BP4WcS9MDfVp:fZIfwADcr29p7fpcSCz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e96e988d061758a49d60b1240dc7fac645c42e698231ce85aac89eb23facd866exe.exe
Files
-
e96e988d061758a49d60b1240dc7fac645c42e698231ce85aac89eb23facd866exe.exe.exe windows:6 windows x64 arch:x64
0475132b30819361af5a9cb96b5a9df7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnhandledExceptionFilter
user32
GetClientRect
advapi32
RegQueryValueExW
shell32
ShellExecuteExA
ole32
CoUninitialize
oleaut32
SysFreeString
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
msvcp140
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
winhttp
WinHttpOpenRequest
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertOpenStore
ws2_32
freeaddrinfo
userenv
UnloadUserProfile
wininet
InternetOpenUrlA
urlmon
URLDownloadToFileA
ntdll
RtlVirtualUnwind
vcruntime140
strrchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
localeconv
Sections
.text Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hyperme Size: - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hyperme Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hyperme Size: 16.7MB - Virtual size: 16.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ