Static task
static1
Behavioral task
behavioral1
Sample
6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe
Resource
win10v2004-20231215-en
General
-
Target
6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19
-
Size
100KB
-
MD5
86134e6029ca8ef5671ddd6611b8c554
-
SHA1
045007b8b8c25bf082b1026fca6a95196d4432c9
-
SHA256
6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19
-
SHA512
29ae3afed735143bd66e87f5cd36b964c38541191e1761feaeff16488225ce2e14b6e307bb1d31563bbdd7fd10b405e4ed22185f19e00dc8dea51f3d0f2d8923
-
SSDEEP
768:W7nkhCphZkSwprRN8tdhin4ak/4LojJRisR5bGJEY8ogXKCC6FQxBDGO+T5/Qcw9:+pbQrTCaU4miBEZoa8y4BgucZu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19
Files
-
6edab3de0a372dc72fdc2c79bc1eefaf0a93968715417b5dab666375852aee19.exe windows:4 windows x86 arch:x86
5bbc2cceab2327de01fb548ec83bda7b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeA
GetLogicalDrives
GetSystemDirectoryA
WaitForSingleObject
CreateProcessA
TerminateProcess
GetExitCodeProcess
ReadFile
FindClose
FindNextFileA
FindFirstFileA
GetVersionExA
GlobalMemoryStatus
Beep
GetLogicalDriveStringsA
CreateThread
GetVolumeInformationA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLastError
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualFreeEx
OpenProcess
GetModuleHandleA
SetStdHandle
LoadLibraryA
GetProcAddress
GetPrivateProfileStringA
GetFileSize
DeleteFileA
SetFilePointer
CreateFileA
WriteFile
CloseHandle
GetVersion
GetCurrentProcess
WinExec
ExitProcess
GetCurrentThreadId
GetModuleFileNameA
GetWindowsDirectoryA
Sleep
SetFileAttributesA
CopyFileA
GetLocalTime
HeapReAlloc
VirtualAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetStartupInfoA
GetCommandLineA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
user32
PostThreadMessageA
ExitWindowsEx
MessageBoxA
advapi32
ControlService
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerA
DeleteService
CreateServiceA
ChangeServiceConfig2A
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
SetServiceStatus
StartServiceCtrlDispatcherA
ws2_32
WSASocketA
bind
listen
accept
inet_addr
gethostname
htons
gethostbyname
connect
send
recv
closesocket
setsockopt
WSACleanup
WSAStartup
socket
shlwapi
PathFileExistsA
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE