Static task
static1
Behavioral task
behavioral1
Sample
789f07a28c6cc6f138bfdd0202fd0923.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
789f07a28c6cc6f138bfdd0202fd0923.exe
Resource
win10v2004-20231215-en
General
-
Target
789f07a28c6cc6f138bfdd0202fd0923
-
Size
299KB
-
MD5
789f07a28c6cc6f138bfdd0202fd0923
-
SHA1
ee29435738c219ba8e7dda532ed9f65c952a7ad2
-
SHA256
c610f08de105a29d0f0d673010e725b938e47a8b8af7073f58d733adc498692f
-
SHA512
00efdcc40750e5e356fcba410226efe2a223eaeca911f6eea021df55608c1855efe2e4acbbb3c50c4b312d45eba2bdb131e6614ca04b482bb842c48d748aa9c8
-
SSDEEP
6144:Pr6BzHpCbghzob8Mw43KtF9TjvHLFRo9q1Z:PsCbvwwKtF9bo9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 789f07a28c6cc6f138bfdd0202fd0923
Files
-
789f07a28c6cc6f138bfdd0202fd0923.exe windows:4 windows x86 arch:x86
34d52caec310cd6286a2dde99286b5bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
GetModuleFileNameW
InterlockedExchangeAdd
SetThreadContext
GetEnvironmentStrings
GetPrivateProfileSectionW
HeapAlloc
TlsFree
LeaveCriticalSection
HeapSize
SetHandleCount
SetThreadPriority
SetVolumeLabelW
CompareStringA
LCMapStringA
LCMapStringW
WideCharToMultiByte
GetLastError
GetLocaleInfoA
VirtualFree
IsValidCodePage
FreeEnvironmentStringsA
GetLocaleInfoW
FreeEnvironmentStringsW
VirtualLock
GetStartupInfoA
SetConsoleCtrlHandler
GetFileType
GetProcAddress
GetProcessShutdownParameters
GetEnvironmentStringsW
Sleep
WriteConsoleOutputCharacterW
EnterCriticalSection
SetLocaleInfoA
GetStartupInfoW
VirtualQuery
HeapDestroy
SetUnhandledExceptionFilter
InterlockedIncrement
SetThreadLocale
GetStringTypeA
MultiByteToWideChar
GetDateFormatA
HeapReAlloc
HeapCreate
ExitProcess
InitializeCriticalSection
SetEnvironmentVariableA
VirtualAlloc
TlsAlloc
QueryPerformanceCounter
GetCurrentProcess
GetTimeZoneInformation
GetModuleHandleA
GetCPInfo
GetStringTypeW
GetTimeFormatA
GetCurrentThreadId
IsDebuggerPresent
TlsSetValue
DeleteCriticalSection
GetCommandLineA
GetCurrentProcessId
WriteFile
GetUserDefaultLCID
CompareStringW
LocalReAlloc
GetTickCount
GetProcessHeap
OutputDebugStringW
GetACP
IsValidLocale
InterlockedDecrement
RtlUnwind
FreeLibrary
GetSystemTimeAsFileTime
InterlockedExchange
GetVersionExA
GlobalCompact
EnumSystemLocalesA
GetCurrentThread
UnhandledExceptionFilter
GetOEMCP
GetStdHandle
HeapFree
TerminateProcess
LoadLibraryA
GetCommandLineW
SetLastError
TlsGetValue
lstrcpy
GetModuleFileNameA
gdi32
SetBitmapDimensionEx
PolyTextOutA
CreateFontIndirectA
GetClipBox
GdiPlayScript
EnableEUDC
CreateScalableFontResourceW
GetNearestColor
CreateRectRgnIndirect
GetRgnBox
comdlg32
GetOpenFileNameA
GetFileTitleW
shell32
ExtractIconExW
SHEmptyRecycleBinA
SHFormatDrive
FreeIconList
ExtractAssociatedIconA
RealShellExecuteA
SHGetFileInfo
SHEmptyRecycleBinW
SHFileOperationA
SHGetDataFromIDListA
SHGetSpecialFolderPathA
SHGetPathFromIDListW
SHGetFileInfoW
DoEnvironmentSubstW
ExtractIconW
InternalExtractIconListA
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ