Static task
static1
Behavioral task
behavioral1
Sample
70b9b6fc87be51bc39a7202031a1357f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
70b9b6fc87be51bc39a7202031a1357f.exe
Resource
win10v2004-20231222-en
General
-
Target
70b9b6fc87be51bc39a7202031a1357f
-
Size
224KB
-
MD5
70b9b6fc87be51bc39a7202031a1357f
-
SHA1
e3bceaf4c2fcfd3080f5428c00adf6950f547d35
-
SHA256
8061882d7c9ac3d50b29058413590dadb92969619e16dc95b4a614036df71c28
-
SHA512
bd7f39af7bfb8bcd39c84515b6ad2e6ec589e4122feaa39f97dc46ffab40a377ea7f6c9c9c2567df8e5dc6ef40af58b42c9665734d1cce6033e28a3b3b68fa7e
-
SSDEEP
3072:+fbA7uidA7AyemWvik8STpUpbQ47+CcfIyZ+cjLtHKfI:Tdw3Wi2T2tPPEZzJHt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70b9b6fc87be51bc39a7202031a1357f
Files
-
70b9b6fc87be51bc39a7202031a1357f.exe windows:5 windows x86 arch:x86
bc8d65d747efa0c4d0902c912ff2f1fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
CreateMutexA
GetLastError
CloseHandle
Sleep
CreateDirectoryA
WaitForSingleObject
TerminateThread
GetTickCount
CreateFileA
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
ExitProcess
SetLastError
CreateProcessA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
IsWow64Process
GetCurrentProcess
InterlockedDecrement
WideCharToMultiByte
SetEndOfFile
CreateFileW
SetEnvironmentVariableA
ReadConsoleW
WriteConsoleW
SetStdHandle
LoadLibraryW
OutputDebugStringW
SetFilePointer
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetOEMCP
GetACP
IsValidCodePage
FlushFileBuffers
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
GetFileType
GetProcessHeap
InterlockedIncrement
EncodePointer
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
lstrlenA
LocalFree
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
AreFileApisANSI
HeapSize
user32
GetForegroundWindow
GetShellWindow
GetWindowRect
GetCursorPos
GetSystemMetrics
GetDesktopWindow
ole32
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
oleaut32
SysAllocString
SysFreeString
VariantClear
ws2_32
send
closesocket
WSACleanup
connect
htons
gethostbyname
socket
WSAStartup
recv
WSAGetLastError
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ