Static task
static1
Behavioral task
behavioral1
Sample
7507ab1eb4e834ddd2100248b73be70a.exe
Resource
win7-20231215-en
General
-
Target
7507ab1eb4e834ddd2100248b73be70a
-
Size
64KB
-
MD5
7507ab1eb4e834ddd2100248b73be70a
-
SHA1
cc44ed9512934fa9ca34bdf5df385f811571bf17
-
SHA256
bba8a1b87e043e5ef577eaa510ba2ee499e2d466f8af85116b98d5889266bbe4
-
SHA512
2c6b840103ffbbb8cebb58b37bb18dd0fea16fb56776980f13e9fad383d3163a37ed1d2fa24b43973a5d1037b0997a7bd77d62caa02eb8444fefc262250d048e
-
SSDEEP
1536:QF3NNTfnB7xBcxQ2mZR7T3O9dNdwp8mMZ:QnNbBFyxQzvTe9dNdM8L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 7507ab1eb4e834ddd2100248b73be70a
Files
-
7507ab1eb4e834ddd2100248b73be70a.exe windows:5 windows x86 arch:x86
c9554e0260bf1a98a7029d163d499f0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
_controlfp
??3@YAXPAX@Z
?terminate@@YAXXZ
wcstok
??2@YAPAXI@Z
wcslen
wcscpy
__CxxFrameHandler
_wcsicmp
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
wcschr
strtok
wcstod
wcstol
wcsncmp
_wcsnicmp
realloc
fflush
fprintf
exit
_cexit
_XcptFilter
_exit
_c_exit
_CxxThrowException
wcsstr
calloc
free
_iob
kernel32
GetTimeFormatW
FileTimeToSystemTime
lstrcmpiW
GetConsoleMode
SetConsoleMode
ReadFile
ReadConsoleW
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
lstrcpynW
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
lstrcmpW
GetComputerNameExW
GetLastError
lstrcpyW
GetStdHandle
GetModuleHandleA
LocalFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
WriteConsoleW
InterlockedIncrement
SetLastError
LocalAlloc
lstrlenW
FormatMessageW
lstrcatW
InterlockedDecrement
QueryPerformanceCounter
user32
LoadStringW
CharUpperW
wsprintfW
mpr
WNetAddConnection2W
WNetGetLastErrorW
WNetCancelConnection2W
ole32
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringByteLen
VariantInit
SysFreeString
SysStringLen
SysAllocString
VariantClear
VariantChangeType
VariantCopy
secur32
GetUserNameExW
ws2_32
WSAGetLastError
WSAStartup
WSACleanup
inet_addr
gethostbyaddr
framedyn
?ReleaseBuffer@CHString@@QAEXH@Z
??YCHString@@QAEABV0@PBG@Z
?Left@CHString@@QBE?AV1@H@Z
??0CHString@@QAE@PBG@Z
??4CHString@@QAEABV0@PBG@Z
?FindOneOf@CHString@@QBEHPBG@Z
?Find@CHString@@QBEHG@Z
?Mid@CHString@@QBE?AV1@H@Z
??4CHString@@QAEABV0@ABV0@@Z
??1CHString@@QAE@XZ
?Format@CHString@@QAAXPBGZZ
?Compare@CHString@@QBEHPBG@Z
?GetBufferSetLength@CHString@@QAEPAGH@Z
?Mid@CHString@@QBE?AV1@HH@Z
?Empty@CHString@@QAEXXZ
?SetAt@CHString@@QAEXHG@Z
??0CHString@@QAE@XZ
?GetData@CHString@@IBEPAUCHStringData@@XZ
netapi32
NetApiBufferFree
NetWkstaTransportEnum
NetServerGetInfo
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 21B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ