Static task
static1
Behavioral task
behavioral1
Sample
7a3db954a3192774ba8d4a66f96a6167.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7a3db954a3192774ba8d4a66f96a6167.exe
Resource
win10v2004-20231222-en
General
-
Target
7a3db954a3192774ba8d4a66f96a6167
-
Size
688KB
-
MD5
7a3db954a3192774ba8d4a66f96a6167
-
SHA1
c02ba6bd43a3948fb866dee51d9bdfdb45aad301
-
SHA256
fdfb8e22f47c569f2639760283d8eade756048d8e6c0df1e9df98af2d22e4838
-
SHA512
24a520d32588d8f09b7a856aa00246d1ff6d4de360ce21274f08acb97d7d16b9e9d43068a87d8d7f07be73868cc2b572a4a000c60705c64cf0d5ef8cb6980851
-
SSDEEP
12288:PsDPJr9LVUou6kwyJFGUjfOn8DhtWXmXbLWZwgHzUeqn68C8KFv6Pya:sPJBeoMPWugIe+68C9APy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a3db954a3192774ba8d4a66f96a6167
Files
-
7a3db954a3192774ba8d4a66f96a6167.exe windows:5 windows x86 arch:x86
92e6b911393d814e82092c7d08c3986f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
GetSystemDirectoryA
FreeLibrary
CloseHandle
Sleep
GetExitCodeThread
CreateThread
GetVersionExA
GetDiskFreeSpaceA
GlobalFree
FindClose
FindCloseChangeNotification
CompareFileTime
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
FileTimeToLocalFileTime
CreateMutexA
ReleaseMutex
WaitForSingleObject
SetThreadPriority
GetCurrentThread
SetFileTime
WriteFile
SetFilePointer
SetFileAttributesA
ReadFile
GetFileSize
GetCurrentThreadId
GetTimeZoneInformation
IsDebuggerPresent
GetTickCount
SetEvent
FindNextChangeNotification
GetLastError
GetStartupInfoA
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
CreateFileW
FindFirstFileW
FindNextFileW
FindFirstChangeNotificationW
GetLogicalDriveStringsW
GetCommandLineW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTempPathW
GetFileAttributesW
GetModuleFileNameW
CreateProcessW
GlobalSize
CopyFileW
MoveFileW
DeleteFileW
CreateDirectoryW
RemoveDirectoryW
LocalFileTimeToFileTime
GetCurrentProcessId
FlushInstructionCache
GetCurrentProcess
VirtualProtect
LoadLibraryA
GetModuleHandleA
VirtualFree
VirtualUnlock
VirtualLock
VirtualAlloc
LoadLibraryExW
GetModuleHandleW
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
Module32Next
Module32First
CreateToolhelp32Snapshot
CreateProcessA
GetCommandLineA
GetProcessTimes
QueryPerformanceCounter
DuplicateHandle
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResumeThread
TerminateThread
CreateSemaphoreA
ReleaseSemaphore
WriteConsoleA
GetStdHandle
GetFileTime
GetFileSizeEx
ExpandEnvironmentStringsA
LocalAlloc
InterlockedExchange
RaiseException
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
ExitThread
ExitProcess
GetStartupInfoW
TerminateProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
CreateFileA
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
SetEndOfFile
GetProcessHeap
HeapSize
GetConsoleOutputCP
WriteConsoleW
Sections
.text Size: 470KB - Virtual size: 470KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ