Static task
static1
Behavioral task
behavioral1
Sample
9a968fbe3895fb2a9de91894a73817ab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9a968fbe3895fb2a9de91894a73817ab.exe
Resource
win10v2004-20231222-en
General
-
Target
9a968fbe3895fb2a9de91894a73817ab
-
Size
220KB
-
MD5
9a968fbe3895fb2a9de91894a73817ab
-
SHA1
2afa56c2ee63fc63e133ff48382f3abfe821bea1
-
SHA256
c8703d225660ba303f7e0a610494d79cf8cff04334404752a0f3d66066cf7be8
-
SHA512
3d1920420c2cd1a3f7235edd377024943a49b38016a540e3ea07f6ab2bf7b747c20a1a33f2abf3f286c86482a22e612671031714d3a64f8222144b0b5600b624
-
SSDEEP
1536:SB3koGmU1M1pek5PhS8S6hyYaEZcPvqiF73GjYfK87oqTLMFUWhRkOVtvoF/:/LK1vdhS8SDDfLgUWbZfvop
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a968fbe3895fb2a9de91894a73817ab
Files
-
9a968fbe3895fb2a9de91894a73817ab.exe windows:4 windows x86 arch:x86
a7e71febfa128c223a752f70992ab961
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetProcessHeap
GetProcAddress
LoadLibraryA
GetVersionExA
CreateProcessA
RtlUnwind
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
SetConsoleCtrlHandler
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
HeapAlloc
HeapFree
GetEnvironmentStrings
GetEnvironmentStringsW
FreeLibrary
GetFileType
DeleteCriticalSection
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
FatalAppExitA
SetUnhandledExceptionFilter
IsBadCodePtr
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers
Sleep
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CloseHandle
WideCharToMultiByte
FreeEnvironmentStringsW
SetHandleCount
user32
EnumWindows
GetWindowThreadProcessId
GetWindowLongA
GetWindowTextA
MessageBoxA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
Sections
.text Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE