Static task
static1
Behavioral task
behavioral1
Sample
a5a6c935c12a7ae2180647a4a521ba565f380fe89441f831a5dc0f45b037e83b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a5a6c935c12a7ae2180647a4a521ba565f380fe89441f831a5dc0f45b037e83b.dll
Resource
win10v2004-20231215-en
General
-
Target
078137cfd2801c9951fa502c4bfb0b52.bin
-
Size
1012KB
-
MD5
41f46e22d0c4906d80d72c3c4991f01a
-
SHA1
a6c52c12af80ac621b7d38b0cc28437293fa715f
-
SHA256
b6093889a650c3ca502ce0e15694399be2c9492134ecb51e4943629472789592
-
SHA512
a226e2f1cfc5b665ba7365152b0391ea3dc9c5e22bf6c0b52029459271ddaa7784c601641564d0073b8c3e38cf1bd61084c689b617d1a84dc56a16c1cf76079f
-
SSDEEP
24576:6vo9X03ByqcZAQpNJvsKu4M6Psvupgeq9Kpk9DGEDKZ7ySS:6w9XbqaptXM6kNgpCGEDKZPS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/a5a6c935c12a7ae2180647a4a521ba565f380fe89441f831a5dc0f45b037e83b.exe
Files
-
078137cfd2801c9951fa502c4bfb0b52.bin.zip
Password: infected
-
a5a6c935c12a7ae2180647a4a521ba565f380fe89441f831a5dc0f45b037e83b.exe.dll windows:6 windows x64 arch:x64
Password: infected
ecc51492b9a27d5c694af6ca9db4f917
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
FlsFree
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
SwitchToFiber
GetTickCount64
Sleep
MoveFileExA
DisableThreadLibraryCalls
CreateThread
FreeLibraryAndExitThread
GetModuleFileNameA
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetLastError
AllocConsole
ConvertThreadToFiber
CreateFiber
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
QueryPerformanceCounter
SizeofResource
FindResourceA
UnmapViewOfFile
CreateFileA
LockResource
CloseHandle
LoadResource
CreateFileMappingW
MapViewOfFile
FreeConsole
GetConsoleWindow
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
FormatMessageA
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
SetEndOfFile
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RaiseException
GetACP
IsValidCodePage
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
SetStdHandle
DeleteFileW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
user32
GetForegroundWindow
MessageBoxA
FindWindowA
GetAsyncKeyState
ShowWindow
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 847KB - Virtual size: 847KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ