Static task
static1
Behavioral task
behavioral1
Sample
e5b2dbe7670cbda102fe8262e0781a0291226735b915b6f5bc198b825e43a6ba.exe
Resource
win7-20231215-en
General
-
Target
e5b2dbe7670cbda102fe8262e0781a0291226735b915b6f5bc198b825e43a6ba
-
Size
900KB
-
MD5
92ee19ab98243dad1709843983c57c4b
-
SHA1
58038ecd70ed0cb96d11205d6b686d40fd9a3daa
-
SHA256
e5b2dbe7670cbda102fe8262e0781a0291226735b915b6f5bc198b825e43a6ba
-
SHA512
a18d5dae4faa6f2cd08a4b034d098878de89000c85a44546e8fb489344cab6f835a651ccc1983fb2dd715b63e4f313d2a9d3959f6fc61592c03c4ba946daec45
-
SSDEEP
24576:j0tyx4woibSF+5JwXgb1081v3iYYKLJxNk:wt445i2F+bmgb1+cxC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e5b2dbe7670cbda102fe8262e0781a0291226735b915b6f5bc198b825e43a6ba
Files
-
e5b2dbe7670cbda102fe8262e0781a0291226735b915b6f5bc198b825e43a6ba.exe windows:6 windows x64 arch:x64
ae130593194bc50dba20ab4c8fed7b33
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateProcessW
GetExitCodeProcess
GetModuleHandleW
CreateMutexW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateDirectoryW
FindFirstFileExW
FindFirstFileExA
RemoveDirectoryW
FindNextFileA
GetFileAttributesA
GetCurrentDirectoryW
GetProcAddress
FreeLibrary
LoadLibraryExW
K32EnumDeviceDrivers
InitializeCriticalSectionEx
HeapSize
K32GetDeviceDriverBaseNameW
HeapReAlloc
RaiseException
FindResourceExW
DecodePointer
HeapDestroy
GetConsoleWindow
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
GetCommandLineA
GetStdHandle
MoveFileExW
SetEnvironmentVariableW
GetFileSizeEx
GetCurrentProcess
GetFileAttributesExW
GetFileAttributesW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
GetCurrentThreadId
ResetEvent
DeleteFileW
GetProcessHeap
HeapAlloc
HeapFree
FlushFileBuffers
WideCharToMultiByte
GetWindowsDirectoryW
DeleteFileA
lstrcatW
OutputDebugStringW
FormatMessageW
MultiByteToWideChar
OutputDebugStringA
lstrcpynW
GetCommandLineW
LocalFree
CreateEventW
WaitForSingleObject
SetEvent
GetPrivateProfileStringW
lstrcpyW
GetFileSize
CloseHandle
CreateFileA
GetLastError
CreateFileW
FindClose
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlPcToFileHeader
RtlUnwindEx
TerminateProcess
FindResourceW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
CompareStringEx
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
WaitForSingleObjectEx
QueryPerformanceCounter
WriteFile
lstrlenW
FindNextFileW
ReadFile
SetFilePointerEx
GetFileInformationByHandle
FormatMessageA
user32
ShowWindow
advapi32
FreeSid
RegCloseKey
OpenServiceW
QueryServiceStatusEx
RegOpenKeyExW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetAce
EqualSid
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetNamedSecurityInfoW
DeleteAce
BuildTrusteeWithSidW
CloseServiceHandle
OpenSCManagerW
oleaut32
VariantClear
userenv
GetAllUsersProfileDirectoryW
Sections
.text Size: 218KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE