Static task
static1
Behavioral task
behavioral1
Sample
0e5a397ff9e7b9b9decb83cdde3a2dc3e6bc37029715e47b2958b527ef7055b3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e5a397ff9e7b9b9decb83cdde3a2dc3e6bc37029715e47b2958b527ef7055b3.exe
Resource
win10v2004-20231222-en
General
-
Target
0e5a397ff9e7b9b9decb83cdde3a2dc3e6bc37029715e47b2958b527ef7055b3
-
Size
2.2MB
-
MD5
d3381c5dea2d1c09a19791d219509d7f
-
SHA1
9ce23dbcc7bf9ea22f5577911dcf7f55d6f7dd11
-
SHA256
0e5a397ff9e7b9b9decb83cdde3a2dc3e6bc37029715e47b2958b527ef7055b3
-
SHA512
79d176153bbcff4a6e6484c93f51b86c1727877d99ddabbdd8fd387f5c0a90f58caa72e9e562713f27e525729184896100c4b48321b5aaa42f41811873cdacaf
-
SSDEEP
49152:S03wVapOomvSmKQY2tlJ7Rzdw1chTcJHXRwD7yv/TE9teG81:S03eapOomvS2D/xw1cIwDm1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e5a397ff9e7b9b9decb83cdde3a2dc3e6bc37029715e47b2958b527ef7055b3
Files
-
0e5a397ff9e7b9b9decb83cdde3a2dc3e6bc37029715e47b2958b527ef7055b3.exe windows:5 windows x86 arch:x86
7e7f052ef9c996cd924896270a6c4a14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LoadResource
FindResourceW
GetProcAddress
GetModuleHandleW
FreeLibrary
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
IsBadStringPtrW
WriteProcessMemory
WaitForSingleObject
OpenProcess
CreateEventW
SetEvent
LoadLibraryA
ResetEvent
VirtualAllocEx
CreateRemoteThread
VirtualFreeEx
OpenMutexW
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
WriteFile
CreateFileW
GetModuleHandleExW
CreateMutexW
ReleaseMutex
MultiByteToWideChar
HeapAlloc
LocalFree
GetProcessHeap
CreateDirectoryW
GetWindowsDirectoryW
ReadFile
SetFilePointer
SetEndOfFile
Sleep
DeleteFileW
GetFileSize
GetTickCount
InterlockedExchange
SetLastError
InterlockedExchangeAdd
lstrlenW
GetPrivateProfileStringW
LoadLibraryW
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
GetVersionExW
GetCurrentProcess
GetFileAttributesW
SetStdHandle
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCurrentThreadId
LeaveCriticalSection
WaitForMultipleObjects
GetModuleFileNameW
InterlockedDecrement
EnterCriticalSection
SizeofResource
DeleteCriticalSection
DecodePointer
RaiseException
CloseHandle
GetLastError
SetErrorMode
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetCurrentProcessId
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
LockResource
GetSystemInfo
SearchPathW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
ResumeThread
OpenEventW
GetACP
WideCharToMultiByte
GetVolumeInformationW
GetDiskFreeSpaceW
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
TryEnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindClose
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
HeapFree
GetComputerNameExW
GlobalAlloc
GlobalFree
SetFileTime
GetFileTime
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
GetSystemDirectoryW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
CopyFileW
GetTempFileNameW
MoveFileW
DeviceIoControl
lstrcatW
lstrcpyW
GetFileSizeEx
CreateProcessW
GetExitCodeProcess
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlCaptureContext
ReleaseSemaphore
GetProcessId
SuspendThread
TerminateThread
CreateThread
GetThreadContext
CreateSemaphoreW
OpenThread
VirtualQueryEx
SetNamedPipeHandleState
DuplicateHandle
TransactNamedPipe
WaitNamedPipeW
GetStdHandle
GetFileType
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameA
SetConsoleCtrlHandler
GetCurrentThread
HeapSize
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
user32
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
UnregisterClassW
PostThreadMessageW
GetMessageW
DispatchMessageW
PeekMessageW
CharNextW
TranslateMessage
advapi32
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
VarUI4FromStr
shlwapi
PathFileExistsW
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ