Static task
static1
Behavioral task
behavioral1
Sample
973cfacbb995e2c7e85703ecaa19d333.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
973cfacbb995e2c7e85703ecaa19d333.exe
Resource
win10v2004-20231222-en
General
-
Target
973cfacbb995e2c7e85703ecaa19d333
-
Size
21KB
-
MD5
973cfacbb995e2c7e85703ecaa19d333
-
SHA1
413784995431b54734d6a2d917d4f0209353b7e0
-
SHA256
00ffeb5d488fabfb3db780a2afcea871d83f650e73a0ba9d1125247f80e102de
-
SHA512
db8085569d6c099a32851677f767f47bbcdd3556d62d5c5c8daacbd2f3ae48f4e6034b71b621826c5475dff39c6bc6250a2f1a17cff96849474d09d6bc1daeaa
-
SSDEEP
384:bhgGKIVLcJfGtP5TiAA9ohsL9kHAf3Toy3H24x7W9Rw5s4nBxb:WoiJfMhTiAA9ohsL93f3MyXxxKRw5sU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 973cfacbb995e2c7e85703ecaa19d333
Files
-
973cfacbb995e2c7e85703ecaa19d333.exe windows:4 windows x86 arch:x86
d1342ce601547e3bf3a48e0a5b44a23b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
urlmon
URLDownloadToCacheFileA
msvcrt
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_strdup
malloc
strtok
realloc
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
strchr
srand
rand
free
calloc
_vsnprintf
_beginthread
strstr
_snprintf
??1type_info@@UAE@XZ
_CxxThrowException
wcslen
fopen
fprintf
fclose
_endthread
__CxxFrameHandler
kernel32
WideCharToMultiByte
LocalFree
GetFileAttributesA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
MoveFileExA
GetTickCount
lstrlenA
SetErrorMode
DeleteFileA
CreateMutexA
GetLastError
ExitProcess
GetSystemDirectoryA
GetShortPathNameA
GetCurrentProcessId
GetLogicalDriveStringsA
GetDriveTypeA
CopyFileA
SetFileAttributesA
GetModuleHandleA
GetModuleFileNameA
Sleep
GetCurrentProcess
user32
ShowWindow
BlockInput
SendMessageA
FindWindowExA
ws2_32
gethostbyname
inet_addr
recv
WSAGetLastError
socket
htons
connect
ioctlsocket
send
WSAStartup
closesocket
WSACleanup
shell32
ShellExecuteA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
ntdll
ZwSystemDebugControl
NtQuerySystemInformation
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantInit
VariantClear
dnsapi
DnsQuery_A
DnsRecordListFree
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ