Static task
static1
Behavioral task
behavioral1
Sample
54185f54670f5e9eb95033e37f7bc3db.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
54185f54670f5e9eb95033e37f7bc3db.exe
Resource
win10v2004-20231215-en
General
-
Target
54185f54670f5e9eb95033e37f7bc3db
-
Size
28KB
-
MD5
54185f54670f5e9eb95033e37f7bc3db
-
SHA1
77db254dcaead58387f29911e22026d33a70c2a2
-
SHA256
411d7bbcb9ec1011c034f84d8443a5e456c2dd2a21ba33adceb3a509a9c08a8b
-
SHA512
c0882a7908c2ea54d65742df1cd47b68cbe75af1dd0d80b1c5fe1cac52e435e886c6cd6ddaec95678f5d70f4be18778c54b6d892e0122111699a9bfceb17997f
-
SSDEEP
192:tVua14iwkSonCemZBdZDv5H0DylQu0tySRuuZq39qhIs0HNnrQXa405A1a6Ybb6/:/XGkNpmlZ5HJQNfiE1VyD4/J+G3losn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54185f54670f5e9eb95033e37f7bc3db
Files
-
54185f54670f5e9eb95033e37f7bc3db.exe windows:4 windows x86 arch:x86
9f646348019f6a270bf6b0ca079b05b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
GetStartupInfoA
SetFileTime
WriteFile
GetCurrentProcess
SetFilePointer
TerminateProcess
Sleep
OpenProcess
CloseHandle
GetFileTime
CreateFileA
GetSystemDirectoryA
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ReadFile
ResumeThread
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetStringTypeW
LoadLibraryA
HeapFree
HeapAlloc
GetModuleHandleA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
advapi32
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
LookupAccountSidA
LookupPrivilegeValueA
shell32
ShellExecuteA
psapi
EnumProcessModules
GetModuleBaseNameA
EnumProcesses
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE