Static task
static1
Behavioral task
behavioral1
Sample
8bb1f6056c2a992ac2cfd38e2d41ba2d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8bb1f6056c2a992ac2cfd38e2d41ba2d.exe
Resource
win10v2004-20231215-en
General
-
Target
8bb1f6056c2a992ac2cfd38e2d41ba2d
-
Size
329KB
-
MD5
8bb1f6056c2a992ac2cfd38e2d41ba2d
-
SHA1
cd5520bbc213f512d9724dde427a3922bb30da1d
-
SHA256
11bb61a81dc9a380c64d0ff40f768d1f5e6eb362d12940abd641f57d19afae60
-
SHA512
ee4f42bc1623b173ad88de496e0a8859bacd108698eaa5a6d994b69888ee18ceb33760b6d85845748c19c2dc78ea8d2fed801585a04540379adccabaafc8537b
-
SSDEEP
6144:MV/cpm7L0zOSuBLbii5bkgVuN+xSKV7Wkrsf7LskpqS06oGYR9Bv:MVEeLgfcXikbkgaISKVsoP9Bv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bb1f6056c2a992ac2cfd38e2d41ba2d
Files
-
8bb1f6056c2a992ac2cfd38e2d41ba2d.exe windows:5 windows x86 arch:x86
d431b5037a9a54c9815e57ab3240c0f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
CreateDirectoryA
GetProcAddress
LoadLibraryA
SetEnvironmentVariableA
GetModuleFileNameA
FindResourceA
LoadResource
SizeofResource
LockResource
WaitForSingleObject
OpenProcess
GetExitCodeProcess
TerminateProcess
GetProcessId
CloseHandle
ReadFile
SetEndOfFile
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
OutputDebugStringW
HeapReAlloc
LoadLibraryExW
LCMapStringW
EncodePointer
DecodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
EnterCriticalSection
LeaveCriticalSection
HeapFree
RaiseException
HeapAlloc
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
GetConsoleCP
GetConsoleMode
GetStringTypeW
ReadConsoleW
shell32
SHFileOperationA
ord680
ShellExecuteExA
pdh
PdhMakeCounterPathA
PdhOpenQueryA
PdhAddCounterA
PdhGetRawCounterValue
PdhCollectQueryData
PdhCloseQuery
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ