Static task
static1
Behavioral task
behavioral1
Sample
ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca.exe
Resource
win10v2004-20231215-en
General
-
Target
ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca
-
Size
292KB
-
MD5
2562895965e8f788293790145a69bdd3
-
SHA1
9aec636dbd172f325923b240a5533de6a5038f4f
-
SHA256
ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca
-
SHA512
b15a7f19741bf0003150fb709548ce90edd6b503b5129cb518c478676613834d2c1baaca0da74a892745712e02199be260f7e32d3490014493dc1c5ab875ce80
-
SSDEEP
6144:kYT5kjA6A1e7Vbl4ESdOFoUC/aikQLOdkaqy:vT+DiehbqVOFq9Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca
Files
-
ac02aee660d44a8bfbc69e9c46cf402fd41e99915e13d0de3977e662ef13b2ca.exe windows:6 windows x64 arch:x64
Password: infected
b7c29b00f762ebe7f8dd55697c3345f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
WriteFile
FormatMessageW
CreateNamedPipeW
GetEnvironmentVariableW
CreateFileW
Sleep
CreateThread
ConnectNamedPipe
ReadDirectoryChangesW
GetCurrentProcess
OutputDebugStringA
GetSystemTime
LoadLibraryExW
OpenEventW
CreateEventW
WriteConsoleW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameW
GetModuleFileNameA
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
SetStdHandle
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
CopyFileW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
FormatMessageA
GetLocaleInfoEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
RtlUnwind
GetCPInfo
ExitProcess
GetStdHandle
GetCommandLineA
GetCommandLineW
GetFileType
GetExitCodeProcess
CreateProcessW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
ole32
CoInitialize
CLSIDFromString
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitializeSecurity
oleaut32
SysFreeString
SysAllocString
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
userenv
CreateEnvironmentBlock
Sections
.text Size: 199KB - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ