Static task
static1
Behavioral task
behavioral1
Sample
0a981658d2204eb6db7e9bb756211568d0e24e0bd8a3be427356e36c91e5e841.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0a981658d2204eb6db7e9bb756211568d0e24e0bd8a3be427356e36c91e5e841.exe
Resource
win10v2004-20231215-en
General
-
Target
0a981658d2204eb6db7e9bb756211568d0e24e0bd8a3be427356e36c91e5e841
-
Size
188KB
-
MD5
5def98a32085e0b1b8e47b0d4b8f0b8d
-
SHA1
af9aabf9e12736ce87b73a4a4f1e1bf117c52aab
-
SHA256
0a981658d2204eb6db7e9bb756211568d0e24e0bd8a3be427356e36c91e5e841
-
SHA512
4f8f80755373ab30fc0229c8920889289839bcec3e4e3484c62c665c965773b162afead3aeb7f7af973bbd07625ae9faaa3ad9cf02ee97ba555494990e712a6c
-
SSDEEP
3072:P8RF0T89C39gasr+jDPSexeaoB1EbX+dgBB0DJXF5P8WyoVhL5:EV9CNtsr+jDPIB1EbX+dgkDpV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a981658d2204eb6db7e9bb756211568d0e24e0bd8a3be427356e36c91e5e841
Files
-
0a981658d2204eb6db7e9bb756211568d0e24e0bd8a3be427356e36c91e5e841.exe windows:6 windows x64 arch:x64
a39ada05436eba9fce69e6623d1e74bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32NextW
FindFirstFileW
FindClose
Process32FirstW
DeleteFileW
MoveFileW
GetLocalTime
CreateToolhelp32Snapshot
lstrcmpiW
lstrcmpW
WinExec
GetModuleFileNameW
GetModuleFileNameA
Sleep
CreateEventW
WaitForSingleObject
SetEvent
GetLastError
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DuplicateHandle
CreateProcessA
GetFullPathNameA
ReadFile
GetStdHandle
WriteFile
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetFileType
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CompareStringW
LCMapStringW
GetStringTypeW
GetDriveTypeW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
HeapReAlloc
GetCurrentDirectoryW
CreateFileW
FlushFileBuffers
WriteConsoleW
SetEndOfFile
CloseHandle
advapi32
SystemFunction036
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2A
ReportEventW
RegisterEventSourceW
DeregisterEventSource
Sections
.text Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ