Static task
static1
Behavioral task
behavioral1
Sample
491c3ddc1947e49cffdeda1a1066edd4b3608948130bcbddc99ab5749c143f50.exe
Resource
win7-20231215-en
General
-
Target
491c3ddc1947e49cffdeda1a1066edd4b3608948130bcbddc99ab5749c143f50
-
Size
1.1MB
-
MD5
8556552762e2144aa063f46b2c7c7868
-
SHA1
8e0966928835f1bb6091c264dae29c7812c23e69
-
SHA256
491c3ddc1947e49cffdeda1a1066edd4b3608948130bcbddc99ab5749c143f50
-
SHA512
0b8ce09b81c9bfe5b705c1d27ce4bd49f402906b135c2bb2be497f6a7e562ec53c92b689ba1f8450de63d38accef35fe743be86edfe79fd3441a48c0cb61ac25
-
SSDEEP
24576:p/RSJRlUqFMzsU4zfS8EJfgYDLXHBlM6TfUSF+5JwXgb1081v3iYYKLJxNk:LYDJEVgULY6Tf3F+bmgb1+cxC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 491c3ddc1947e49cffdeda1a1066edd4b3608948130bcbddc99ab5749c143f50
Files
-
491c3ddc1947e49cffdeda1a1066edd4b3608948130bcbddc99ab5749c143f50.exe windows:6 windows x86 arch:x86
d05f26c0c4671086d630f2289e0bf63b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetFileAttributesA
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
SetFileAttributesA
GetProcAddress
CopyFileA
CreateProcessA
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
FindFirstFileA
FindNextFileA
WriteConsoleW
GetConsoleMode
Sleep
CreateToolhelp32Snapshot
GetModuleHandleA
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
FindClose
CreateMutexW
GetDynamicTimeZoneInformation
WriteFile
WriteConsoleA
GetStdHandle
lstrlenW
GetCurrentProcess
FindNextFileW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentProcessId
GetModuleFileNameA
SetEndOfFile
HeapSize
ReadConsoleW
ReadFile
CreateFileW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetExitCodeThread
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwind
RaiseException
ExitThread
GetModuleHandleExW
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetFileType
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
GetConsoleCP
MoveFileExW
GetFileSizeEx
CreateDirectoryW
advapi32
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
SetSecurityDescriptorDacl
RegCloseKey
RegDeleteKeyExW
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
RegEnumKeyExW
StartServiceW
InitializeSecurityDescriptor
RegOpenKeyExW
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
RegQueryValueExW
OpenServiceA
shell32
SHGetFolderPathAndSubDirA
SHGetFolderPathA
ole32
CLSIDFromProgID
CoInitialize
CoCreateInstance
shlwapi
PathQuoteSpacesW
PathFileExistsW
Sections
.text Size: 379KB - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE