Static task
static1
Behavioral task
behavioral1
Sample
9761f25edae617a698693a1e01825589.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9761f25edae617a698693a1e01825589.exe
Resource
win10v2004-20231215-en
General
-
Target
9761f25edae617a698693a1e01825589
-
Size
850KB
-
MD5
9761f25edae617a698693a1e01825589
-
SHA1
a011bdd3b875eeb7be6a894561dbe4ce56116cc2
-
SHA256
40c76f550a30c8e72340f8b13abc6790b3037efd94dc2abdb76d26fafca46be0
-
SHA512
62446fcbf29d1eb133c0d503afae85a98a5e9f146f24cefa13757e3afa089765732c849c55310fd4adbe269296a5901f5a5ebef92c3b4411bb2769dcc32a7fb1
-
SSDEEP
24576:hfR4QUeEH3xybADOErzRz/sl6g7LfI9e:L4dXH3QbAKE/Rz/+6B9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9761f25edae617a698693a1e01825589
Files
-
9761f25edae617a698693a1e01825589.exe windows:5 windows x86 arch:x86
6598c786e4e0e7ecf7ede24c33ab86f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
apphelp
SdbFindNextTag
ApphelpGetNTVDMInfo
ApphelpCheckRunApp
SdbTagIDToTagRef
SdbReadDWORDTagRef
SdbReadWORDTag
SdbInitDatabase
SdbGetTagDataSize
SdbFindFirstNamedTag
ApphelpUpdateCacheEntry
SdbFindFirstMsiPackage
SdbGetStringTagPtr
SdbGrabMatchingInfoEx
SdbReadDWORDTag
SdbFindNextTagRef
SdbOpenApphelpDetailsDatabase
SdbOpenDatabase
SdbUnregisterDatabase
SdbReleaseDatabase
SdbFindNextMsiPackage
snmpapi
SnmpSvcSetLogLevel
SnmpTfxClose
SnmpTfxQuery
SnmpSvcGetUptime
SnmpUtilUnicodeToAnsi
SnmpUtilIdsToA
SnmpSvcAddrToSocket
SnmpUtilUTF8ToUnicode
SnmpUtilAnsiToUnicode
SnmpUtilOidFree
SnmpUtilVarBindListFree
SnmpUtilMemAlloc
SnmpUtilAsnAnyCpy
SnmpUtilAsnAnyFree
SnmpSvcGetEnterpriseOID
SnmpUtilPrintAsnAny
SnmpSvcAddrIsIpx
SnmpUtilOctetsFree
SnmpUtilMemReAlloc
SnmpUtilOidCpy
SnmpSvcInitUptime
SnmpUtilPrintOid
kernel32
AllocateUserPhysicalPages
HeapCreate
DisconnectNamedPipe
RestoreLastError
AddLocalAlternateComputerNameW
GetModuleHandleW
FreeUserPhysicalPages
SetConsoleCursor
VirtualAlloc
GetTapeStatus
WriteProfileSectionW
GetConsoleCommandHistoryA
InterlockedPopEntrySList
GetSystemInfo
LocalShrink
InitializeCriticalSection
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
FindResourceW
LoadLibraryA
user32
ShowWindowAsync
GetKeyboardState
SetMenuDefaultItem
EnumWindowStationsA
GetWindowLongW
CallWindowProcW
DrawTextExA
OemToCharW
OpenIcon
AdjustWindowRect
UpdateWindow
GetParent
HideCaret
EnumDisplaySettingsA
GetMenuItemCount
GetCursorInfo
TileWindows
GetWindowModuleFileNameW
RegisterHotKey
RegisterWindowMessageW
SwapMouseButton
CreateCursor
GetClipboardData
WinHelpW
odbctrac
TraceSQLConnect
TraceSQLGetStmtAttr
TraceSQLDriverConnect
TraceSQLPrimaryKeysW
TraceSQLGetDescField
TraceSQLParamOptions
TraceSQLDriversW
TraceSQLAllocHandleStdW
TraceSQLGetConnectAttrW
TraceSQLAllocStmt
TraceSQLDescribeCol
TraceSQLDisconnect
TraceSQLSetCursorNameW
TraceSQLMoreResults
TraceSQLGetDiagRecW
TraceSQLEndTran
TraceSQLGetData
TraceSQLGetDescRecW
crtdll
fgets
_ismbcl0
_rmdir
_ismbbkalnum
ceil
_mbsinc
_exit
ldexp
_setmode
_basemajor_dll
_fdopen
_mktemp
_strnset
towlower
_strlwr
fread
_CIsqrt
_endthread
_itoa
getenv
Sections
.text Size: 725KB - Virtual size: 725KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ