Static task
static1
Behavioral task
behavioral1
Sample
579921fe28c3aa03343cbab35eb4ecb0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
579921fe28c3aa03343cbab35eb4ecb0.exe
Resource
win10v2004-20231215-en
General
-
Target
579921fe28c3aa03343cbab35eb4ecb0
-
Size
680KB
-
MD5
579921fe28c3aa03343cbab35eb4ecb0
-
SHA1
841cea3604ff0b369101424d18a750b1851d3b88
-
SHA256
97090f3f9f4e6d705110158dd3f1f1beb779daab9145f06106a3630bd1f8fee6
-
SHA512
c096e635d5b2a7c5bef7b496fa7b81a747e92a6b86901c2fae50ffbb9b900011e971968f21e17a9fb0e1b683eb3a7ee7cc6d91f3062daa55605e9c0234489367
-
SSDEEP
12288:M3uM4+nKTGrBOoFqFfuO9WFU94HIYjPpgKVMBARZN/yvtDdlLc9FXtu7h:Me+CGeQOh9+VjPpg3BsglLcfXC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 579921fe28c3aa03343cbab35eb4ecb0
Files
-
579921fe28c3aa03343cbab35eb4ecb0.exe windows:5 windows x86 arch:x86
e52f8fc3e1a423f4bf0b7594819f81a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLocalTime
GetProcAddress
LoadLibraryA
SystemTimeToFileTime
LoadLibraryW
GetModuleHandleA
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
CloseHandle
WaitForSingleObject
InitializeCriticalSection
lstrlenW
WideCharToMultiByte
MoveFileExW
GetTempFileNameW
GetTempPathW
DeleteFileW
MoveFileW
WriteFile
ReadFile
GetFileSize
CreateFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
SleepEx
SetFileAttributesW
CreateProcessW
GetModuleFileNameW
GetComputerNameA
Sleep
GetSystemTime
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
LocalAlloc
WaitForMultipleObjects
VirtualQueryEx
ReadProcessMemory
Module32NextW
Module32FirstW
ProcessIdToSessionId
SetEndOfFile
WriteConsoleW
SetStdHandle
GetStringTypeW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RtlUnwind
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeLibrary
InterlockedExchange
ole32
CoCreateInstance
CoInitialize
shell32
ShellExecuteW
SHGetSpecialFolderPathW
shlwapi
PathIsRootW
PathFileExistsW
PathRemoveExtensionW
PathAddExtensionW
PathAppendW
psapi
GetModuleFileNameExW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Sections
.text Size: 369KB - Virtual size: 369KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 232KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ