Static task
static1
Behavioral task
behavioral1
Sample
714a9710f52bbc1daec98d482a73b5f0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
714a9710f52bbc1daec98d482a73b5f0.exe
Resource
win10v2004-20231222-en
General
-
Target
714a9710f52bbc1daec98d482a73b5f0
-
Size
506KB
-
MD5
714a9710f52bbc1daec98d482a73b5f0
-
SHA1
a95e2c5dbdaa6c01744c28758dfaaac39308da6f
-
SHA256
3455c434124f3352544a6f3dac4d7ec553ec9f326494195ac60d552da0400aee
-
SHA512
2fa0b836247c2124e65be3014883963496f264520928d522a19ca1129ff6eb3a2dc50067376c6ae0f89546bd4364eba0d094151dfe066d22462c712e6bbc8ba4
-
SSDEEP
12288:nbqovAbDZ7OPch76c/YsMBtF1K1exSn4t+G3R37Dss:n9qD9McYc/YbLyIxSnc39D
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 714a9710f52bbc1daec98d482a73b5f0
Files
-
714a9710f52bbc1daec98d482a73b5f0.exe windows:4 windows x86 arch:x86
6a5483163a75b8ef1ad04f99391d39a8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptEnumProviderTypesA
RegDeleteKeyA
CryptGetDefaultProviderA
LookupAccountNameW
CryptSetProviderExW
DuplicateTokenEx
RegCreateKeyW
RegQueryMultipleValuesA
RegConnectRegistryW
RegSetValueExA
CryptGenRandom
RegReplaceKeyW
AbortSystemShutdownA
LookupPrivilegeValueA
RegReplaceKeyA
RegEnumKeyA
CryptGetUserKey
CryptAcquireContextA
RegOpenKeyExW
kernel32
HeapAlloc
GetConsoleCP
GetOEMCP
GetCurrentProcessId
VirtualFree
TlsFree
CloseHandle
SetUnhandledExceptionFilter
WaitNamedPipeW
TlsSetValue
GetVolumeInformationW
OpenMutexA
GetLocaleInfoW
VirtualQuery
IsDebuggerPresent
HeapReAlloc
GetConsoleMode
WriteFile
ReadFile
LeaveCriticalSection
GetConsoleOutputCP
DeleteCriticalSection
GetModuleHandleA
CreateThread
GetModuleHandleW
GetCurrentProcess
GlobalFindAtomA
GetSystemDefaultLangID
GetConsoleScreenBufferInfo
GetStartupInfoW
FreeEnvironmentStringsW
InterlockedIncrement
SetStdHandle
QueryPerformanceCounter
SetEnvironmentVariableA
LCMapStringA
RtlUnwind
lstrcpyW
GetStdHandle
FlushFileBuffers
CreateFileA
GetFileType
GetModuleFileNameW
HeapFree
GetUserDefaultLCID
InterlockedExchange
EnterCriticalSection
GetCurrentThread
GetWindowsDirectoryA
GetTimeFormatA
HeapDestroy
EnumSystemLocalesA
LCMapStringW
GetLastError
CompareStringW
UnhandledExceptionFilter
GetACP
SetHandleCount
GetProcAddress
HeapCreate
SetFilePointer
GetExitCodeProcess
SetLastError
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CreateMutexA
GetStringTypeW
GetSystemTimeAsFileTime
WriteConsoleW
TlsAlloc
MultiByteToWideChar
GetCPInfo
IsValidLocale
GlobalHandle
CompareStringA
FreeLibrary
GetEnvironmentStringsW
ExitProcess
WideCharToMultiByte
GetDateFormatA
GetTickCount
GetCommandLineA
GetCommandLineW
HeapSize
GetStringTypeA
InterlockedDecrement
SetComputerNameW
GetModuleFileNameA
GetPrivateProfileStringW
TerminateProcess
GetCurrentThreadId
GetStartupInfoA
GetLocaleInfoA
WriteConsoleA
LocalCompact
CreateRemoteThread
GetTimeZoneInformation
ResumeThread
TlsGetValue
EnumCalendarInfoA
WritePrivateProfileStructW
VirtualAlloc
LockFile
IsValidCodePage
SetConsoleCtrlHandler
Sleep
comctl32
InitCommonControlsEx
user32
RegisterClassExA
WinHelpA
ShowCursor
SystemParametersInfoW
SwitchToThisWindow
LoadBitmapA
DefMDIChildProcW
DdeGetData
GetMenuState
CreateIconIndirect
DdeAccessData
EnumDisplaySettingsW
DrawIcon
CallNextHookEx
DlgDirSelectComboBoxExA
PostThreadMessageW
SetClassWord
LockWindowUpdate
RegisterClassA
comdlg32
ChooseFontW
Sections
.text Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 315KB - Virtual size: 314KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ