Static task
static1
Behavioral task
behavioral1
Sample
996d6a5ee0051837238663d7a9ea8d13.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
996d6a5ee0051837238663d7a9ea8d13.exe
Resource
win10v2004-20231222-en
General
-
Target
996d6a5ee0051837238663d7a9ea8d13
-
Size
228KB
-
MD5
996d6a5ee0051837238663d7a9ea8d13
-
SHA1
ba5fd4673d252589c35fad340c85f539745df944
-
SHA256
3ca089efe54a588b9185e4600da0adb7a6633e725b98732c7e87829b9f5fa6f8
-
SHA512
58da1d1f37d387c090be75314a2f688da5d25b9118798a1c80c9bb1b3d832f23ff647cd0d58ae4aed5f7c7f8d0e339e2ac06ce19eed23e6cfce187549f20e27b
-
SSDEEP
6144:QcRzUcx0KmA4Qfr19EnWdAN0xY0GMvS+a5w45yhu:Q80RQj19KNeYf5w+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 996d6a5ee0051837238663d7a9ea8d13
Files
-
996d6a5ee0051837238663d7a9ea8d13.exe windows:4 windows x86 arch:x86
5af067a7ceafc86fc2076370ad8f1e6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
bind
listen
accept
WSAStartup
socket
WSACleanup
gethostbyname
inet_addr
ioctlsocket
htons
connect
send
recv
closesocket
wininet
InternetSetOptionA
advapi32
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
OpenServiceA
StartServiceA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
RegSetValueExA
RegCloseKey
kernel32
GetStringTypeA
IsBadReadPtr
GetStringTypeW
SetStdHandle
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsBadCodePtr
CreateMutexA
CloseHandle
WriteFile
CreateFileA
ReadFile
WaitForSingleObject
ReleaseMutex
GetLastError
GetWindowsDirectoryA
CreateThread
Sleep
GetLocalTime
OutputDebugStringA
FindClose
FindNextFileA
FindFirstFileA
SetEvent
CreateEventA
CreateProcessA
DeleteFileA
GetTempPathA
TerminateProcess
ContinueDebugEvent
SetThreadContext
WaitForDebugEvent
GetThreadContext
GetStartupInfoA
GetTickCount
GetProcAddress
LoadLibraryA
CopyFileA
GetModuleFileNameA
TerminateThread
SetFileAttributesA
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetEnvironmentVariableA
CreateDirectoryA
GetCommandLineA
VirtualProtect
VirtualQuery
EnterCriticalSection
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
RtlUnwind
GetTimeZoneInformation
GetSystemTime
HeapFree
HeapAlloc
ExitProcess
GetCurrentProcess
GetModuleHandleA
GetVersion
RaiseException
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
FlushFileBuffers
SetUnhandledExceptionFilter
GetCPInfo
Sections
.text Size: 156KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE