Static task
static1
Behavioral task
behavioral1
Sample
9789e6920e94c842f4a66bbf3a315ce4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9789e6920e94c842f4a66bbf3a315ce4.exe
Resource
win10v2004-20231215-en
General
-
Target
9789e6920e94c842f4a66bbf3a315ce4
-
Size
332KB
-
MD5
9789e6920e94c842f4a66bbf3a315ce4
-
SHA1
df5599a4070a78683125233d84c2bd1afce84803
-
SHA256
00aaaebce7bd725b1ff2a08378d24f4987f86f7a25d14bbbb8993e8dd1e76863
-
SHA512
ec07e40b3279d27fa22368448b9774a3239b5dce05a30397bf68b63ceb22ff05205aecc7795317d6964ac4edae8464732ea772ea5acb16b6646103ebb1e1bb71
-
SSDEEP
6144:CfYsVCdJNUHCuFndT1WhNYXKpUp+oT5yYrctZXGwd6a3KeeNAjVKLOo:wbVCdJwRl1INYt8oTQ1tZWwB3KezBKSo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9789e6920e94c842f4a66bbf3a315ce4
Files
-
9789e6920e94c842f4a66bbf3a315ce4.exe windows:4 windows x86 arch:x86
570bdbf51be5cbb68f783e8aeec1d6b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
DisconnectNamedPipe
GetExitCodeProcess
CreateFileA
GetFileSize
user32
SendMessageA
Sections
OhyAGzLr Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
hwSMvgkJ Size: 4KB - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
QPQxIRvb Size: 276KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VUStmvDM Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE