Static task
static1
Behavioral task
behavioral1
Sample
5ab4900dc9350f2d19f5a9de968244d6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5ab4900dc9350f2d19f5a9de968244d6.exe
Resource
win10v2004-20231215-en
General
-
Target
5ab4900dc9350f2d19f5a9de968244d6
-
Size
11.9MB
-
MD5
5ab4900dc9350f2d19f5a9de968244d6
-
SHA1
0c81011d8ec76327991b8eaa591f429cca969084
-
SHA256
35bd278f0043d975e4aba39d1db3f59a5c05cb977613177dfefaceaa17d5b6d9
-
SHA512
9f74bfbd77bc204263c25398c42a79ca76d07a7ab375ac9acaab7d58558f6267d2c1fb1d207f191c82fc4dafae75e88d39415eb9d020456867895bf261679923
-
SSDEEP
24576:VCKmbpaVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVN:LI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ab4900dc9350f2d19f5a9de968244d6
Files
-
5ab4900dc9350f2d19f5a9de968244d6.exe windows:5 windows x86 arch:x86
a9846ce1b092483e13eb4ec129769170
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
ResumeThread
ClearCommBreak
GetSystemRegistryQuota
GetSystemTimes
GetTickCount
GetSystemTimeAdjustment
lstrcmpA
lstrcatW
_lcreat
CreateSemaphoreW
OpenFileMappingA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetCommandLineA
ExpandEnvironmentStringsA
GetFirmwareEnvironmentVariableA
SwitchToThread
EnumResourceLanguagesA
FindAtomW
GetTempPathW
FindFirstFileExW
MoveFileExW
CreateHardLinkW
IsBadStringPtrA
OpenJobObjectA
FindNextVolumeMountPointW
DeleteVolumeMountPointW
ZombifyActCtx
GetNumaHighestNodeNumber
EnumDateFormatsW
GetSystemDefaultLangID
GetCurrentConsoleFont
WriteConsoleA
CloseHandle
WriteConsoleW
HeapUnlock
GlobalAlloc
GetProcAddress
SetFirmwareEnvironmentVariableA
InterlockedIncrement
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineW
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
ExitProcess
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
SetLastError
GetCurrentThread
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
CreateFileW
user32
GetMonitorInfoW
advapi32
RegSetValueExW
PrivilegedServiceAuditAlarmA
ReportEventA
QueryServiceLockStatusW
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 97KB - Virtual size: 49.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11.5MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ