Static task
static1
Behavioral task
behavioral1
Sample
544ee7fa8710bbf87e9e9a4b61e9b41a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
544ee7fa8710bbf87e9e9a4b61e9b41a.exe
Resource
win10v2004-20231222-en
General
-
Target
544ee7fa8710bbf87e9e9a4b61e9b41a
-
Size
48KB
-
MD5
544ee7fa8710bbf87e9e9a4b61e9b41a
-
SHA1
f21a45627287726dfec99ea3b5c6982552a8bed7
-
SHA256
9e48a8ca58c69c8b06e3adf7809776f33ba8b77beb9154a6f97e5a419621a2b2
-
SHA512
ad5632e87194df3ad9bac4dbfb47279dd28823224bb55a2674f922f1490bcf16cb4671f58212a15d4a0a934f66d34b701940c29b69d5fd9af368e77fa93ed570
-
SSDEEP
768:YRiV7pvtILwx1hIcieFeIm9e8MyARNQvCy4k3+A3RuLT+V7RIn4Y/dNKez:c+YLYXIKYMpQGkNmlMe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 544ee7fa8710bbf87e9e9a4b61e9b41a
Files
-
544ee7fa8710bbf87e9e9a4b61e9b41a.exe windows:4 windows x86 arch:x86
265de66773c2f631828f7797a11b28c5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCommandLineA
FlushConsoleInputBuffer
GetLogicalDriveStringsA
GetUserGeoID
GetConsoleWindow
PostQueuedCompletionStatus
GetModuleHandleA
ReadConsoleA
SetConsoleKeyShortcuts
GetConsoleAliasExesLengthA
Module32Next
EndUpdateResourceA
UnlockFileEx
FlushFileBuffers
SetVolumeLabelA
GetTapePosition
HeapCreate
IsBadStringPtrA
GetThreadPriorityBoost
FormatMessageA
UnregisterWait
GetConsoleAliasesA
Process32Next
ProcessIdToSessionId
WriteProfileStringA
ChangeTimerQueueTimer
RegisterWaitForSingleObject
CreatePipe
SignalObjectAndWait
GetModuleFileNameA
GetCommTimeouts
WaitForSingleObject
CompareFileTime
FlushViewOfFile
GetConsoleFontInfo
ReadConsoleOutputCharacterA
ClearCommError
UnregisterWaitEx
GetVolumeNameForVolumeMountPointA
GetLocaleInfoA
GetDllDirectoryA
GetDateFormatA
HeapFree
GetSystemTime
IsBadWritePtr
GetExitCodeProcess
lstrcmpiA
OpenProcess
GetTempFileNameA
GlobalLock
GetFileType
VirtualProtect
WaitForMultipleObjects
ExitVDM
GetCurrentConsoleFont
Heap32First
TransmitCommChar
VirtualAlloc
OpenEventA
WriteProcessMemory
GetShortPathNameA
UpdateResourceA
WriteConsoleOutputCharacterA
GetThreadLocale
CloseHandle
GetSystemDirectoryA
EnumUILanguagesA
TerminateThread
GetCurrentThreadId
WinExec
Process32First
GetCalendarInfoA
LZOpenFileA
SetTapeParameters
HeapQueryInformation
GetCommTimeouts
GetNamedPipeHandleStateA
GetCurrentDirectoryA
GetWindowsDirectoryA
SetFilePointerEx
OpenEventA
IsSystemResumeAutomatic
FindNextVolumeA
WriteConsoleOutputCharacterW
SignalObjectAndWait
IsDebuggerPresent
IsBadCodePtr
GetExitCodeThread
EndUpdateResourceA
FindNextVolumeMountPointA
GetPrivateProfileSectionA
CopyFileExW
HeapDestroy
GetComputerNameA
SetMessageWaitingIndicator
WriteConsoleInputA
HeapFree
GetFileAttributesExA
RemoveDirectoryA
GetCurrentThread
GetFileInformationByHandle
GetLogicalDrives
WriteConsoleOutputA
advapi32
InitializeSid
ntdll
RtlGetLastWin32Error
Sections
CODE Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ