Behavioral task
behavioral1
Sample
7c71c41506fdc306efd7c00f359abbfd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7c71c41506fdc306efd7c00f359abbfd.exe
Resource
win10v2004-20231215-en
General
-
Target
7c71c41506fdc306efd7c00f359abbfd
-
Size
631KB
-
MD5
7c71c41506fdc306efd7c00f359abbfd
-
SHA1
6e13c0866589e928e074c85e0225d7cbca241c36
-
SHA256
663d11c6a687961e8b5cda09b720a9511d972a9ea164cf8c385037a33eea53fa
-
SHA512
35b15a277542d63c956b8f5d4250fd702d7c25861fb4b0f1ba873511f78837d5ec43f07b00c00a5e7afaff629f0f4c98001647528529529d36cd07626301db72
-
SSDEEP
12288:k36SNp0mWujfTYiVgDR6FmgGak6H3lP3XJik0YhBhrLz0:k3fYj0F876j0KDrf0
Malware Config
Signatures
-
Privateloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7c71c41506fdc306efd7c00f359abbfd
Files
-
7c71c41506fdc306efd7c00f359abbfd.exe windows:6 windows x86 arch:x86
d0f5faff0d9a42cffdcdc1bfda477ddc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
GetModuleHandleA
SetCurrentDirectoryA
lstrcpyA
GetProcAddress
GetLastError
HeapFree
lstrlenA
HeapAlloc
lstrcpynA
GetProcessHeap
WriteConsoleW
SetEndOfFile
HeapReAlloc
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
RaiseException
EncodePointer
FreeLibrary
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
MultiByteToWideChar
LCMapStringW
DeleteFileW
GetConsoleOutputCP
GetFileSizeEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
CreateFileW
FlushFileBuffers
HeapSize
DecodePointer
user32
CharNextA
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ