Static task
static1
Behavioral task
behavioral1
Sample
97224caea74c8036d4597efb170a0013.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97224caea74c8036d4597efb170a0013.exe
Resource
win10v2004-20231215-en
General
-
Target
97224caea74c8036d4597efb170a0013
-
Size
1.9MB
-
MD5
97224caea74c8036d4597efb170a0013
-
SHA1
b55e385c561a65509b49c1c52394443b65d7c791
-
SHA256
a9a16c8cc0135626137c4e3d1fce076429fe7167b30bf0313fb58812ad65d530
-
SHA512
d0025b5d144988275fce343ea48d0239d9b82fa4ba857d1f1d3a8bef23d48c82a50d78ad78e7d5a9d1f6595b02195f1d3ab47f7c1bdf752453f547db1c801366
-
SSDEEP
12288:p5274pKyhXzHkuoG+R6kNOS13IVAz7X/yEWUwkFKj5umynYV2rcD5/T9y0rqB79D:p13hm63S13ISv/vPFKIR6NrI7VV1Upq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97224caea74c8036d4597efb170a0013
Files
-
97224caea74c8036d4597efb170a0013.exe windows:6 windows x86 arch:x86
70ca654381b8830141349dbdfc1b2199
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetConsoleScreenBufferInfo
HeapFree
SetLastError
SetConsoleTextAttribute
VirtualFree
SetConsoleTitleA
GetCurrentProcess
GetStdHandle
VirtualAlloc
TerminateProcess
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetExitCodeThread
Sleep
GetTempPathA
LoadLibraryA
WriteProcessMemory
CloseHandle
GetNativeSystemInfo
CreateThread
HeapAlloc
FillConsoleOutputAttribute
GetProcAddress
VirtualAllocEx
ExitProcess
GetProcessHeap
FreeLibrary
GetConsoleWindow
lstrcmpiA
VirtualFreeEx
IsBadReadPtr
SetConsoleCursorPosition
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
SetEnvironmentVariableW
Process32First
Process32Next
FillConsoleOutputCharacterA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
GetLastError
LoadLibraryExW
WriteFile
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
ReadFile
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
user32
ShowWindow
GetWindowRect
MoveWindow
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
shell32
SHGetSpecialFolderPathA
ntdll
RtlCreateUserThread
NtClose
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ