Static task
static1
Behavioral task
behavioral1
Sample
df8679bb6f4b68ccc6dbc7e45cb39d92db937678d81561874cc87d63246ebb94.exe
Resource
win7-20231215-en
General
-
Target
df8679bb6f4b68ccc6dbc7e45cb39d92db937678d81561874cc87d63246ebb94
-
Size
1.4MB
-
MD5
1a3cb9e02f7776855183ed4af5cbe905
-
SHA1
8940ab93241f52e60e72cb764e9a81b54a14a30d
-
SHA256
df8679bb6f4b68ccc6dbc7e45cb39d92db937678d81561874cc87d63246ebb94
-
SHA512
1df629597ddf151b836c974fdde1b344a47498ca956a92b68b90ab2afe16cf84e6e97bceeebbc6d31e97aee5866df31bcdba46ae708be56abaa16e5ad9186401
-
SSDEEP
12288:QF3h/Y+iAlQz3JWJnpz/n/trAUd4RivsiNG8da0BKzIpAaQQPmGrl6ArK73s:QpZYTASz3JWBntrA04EkiNG8BwXGF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df8679bb6f4b68ccc6dbc7e45cb39d92db937678d81561874cc87d63246ebb94
Files
-
df8679bb6f4b68ccc6dbc7e45cb39d92db937678d81561874cc87d63246ebb94.exe windows:6 windows x64 arch:x64
89816a2fd1b7618c959becd0156a68b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetLastError
CreateDirectoryA
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
RemoveDirectoryA
SetFileAttributesA
GetSystemTimeAsFileTime
GetModuleFileNameA
CopyFileA
SetEnvironmentVariableA
WaitForSingleObject
Sleep
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
K32EnumProcesses
K32GetModuleFileNameExA
K32GetProcessImageFileNameA
GetEnvironmentVariableA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
GetFileSize
ReadFile
SetCurrentDirectoryA
MoveFileExA
SetEndOfFile
HeapReAlloc
HeapSize
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapFree
HeapAlloc
GetFileType
MultiByteToWideChar
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetFileAttributesExW
GetConsoleMode
ReadConsoleW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
GetStringTypeW
CreateFileW
WriteConsoleW
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE