Static task
static1
Behavioral task
behavioral1
Sample
6d62671e5c48873bbc3cf2a4e5e31a8cbb7a065cd1d2aa6db3920e25dd3f2554.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6d62671e5c48873bbc3cf2a4e5e31a8cbb7a065cd1d2aa6db3920e25dd3f2554.exe
Resource
win10v2004-20240226-en
General
-
Target
6d62671e5c48873bbc3cf2a4e5e31a8cbb7a065cd1d2aa6db3920e25dd3f2554
-
Size
508KB
-
MD5
ee5e65c176643ad833aab4d3f74f5696
-
SHA1
fb8bb4b0ffec21db2006b643adeff9fd5e974106
-
SHA256
6d62671e5c48873bbc3cf2a4e5e31a8cbb7a065cd1d2aa6db3920e25dd3f2554
-
SHA512
5a99474d096b6ffe01ab873741133eb83bfe8d62421b4d4fa45298e4525bbcacc10b5b114ac714f727a00fb4bbacfeec1c9064de9a5646487d6b5e293a9bda06
-
SSDEEP
6144:/W0J07EHxsWKKCbrZXDbI33z5P/kjguInr39tAOLPvI1ILz:e4CWKKCrZTGF/k8uMxtxPvvz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6d62671e5c48873bbc3cf2a4e5e31a8cbb7a065cd1d2aa6db3920e25dd3f2554
Files
-
6d62671e5c48873bbc3cf2a4e5e31a8cbb7a065cd1d2aa6db3920e25dd3f2554.exe windows:4 windows x86 arch:x86
049cd5c61c56b1b627f941860ff6c3c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
GetLocalTime
GetTempPathA
OpenFileMappingA
CreateToolhelp32Snapshot
QueryDosDeviceA
OpenProcess
GetPrivateProfileStringA
Process32NextW
MapViewOfFile
GetLogicalDriveStringsA
UnmapViewOfFile
Process32FirstW
CloseHandle
GetTickCount
DeleteFileA
LockResource
SizeofResource
CreateFileA
MultiByteToWideChar
LoadResource
WaitForSingleObject
CreateProcessA
FindResourceA
GetModuleHandleA
InitializeCriticalSection
WriteFile
GetVersionExA
GetFileSize
GetFileAttributesW
ReadFile
WideCharToMultiByte
GetCurrentDirectoryW
SetFilePointer
SystemTimeToFileTime
CreateDirectoryW
LocalFileTimeToFileTime
SetFileTime
CreateFileW
CreateEventA
WaitNamedPipeA
SetEvent
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
Sleep
OutputDebugStringA
EnterCriticalSection
GetModuleFileNameA
GetFileAttributesA
SetUnhandledExceptionFilter
GetEnvironmentStrings
LeaveCriticalSection
LoadLibraryA
GetWindowsDirectoryA
FreeEnvironmentStringsA
FlushFileBuffers
lstrlenA
GetThreadLocale
SetEndOfFile
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetProcessHeap
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetProcAddress
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
user32
wsprintfA
LoadStringA
advapi32
RegSetValueExA
RegCreateKeyA
RegCloseKey
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
oleaut32
VariantClear
SysAllocStringLen
SysFreeString
SysAllocString
psapi
GetProcessImageFileNameA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
iphlpapi
GetAdaptersInfo
wininet
HttpSendRequestA
InternetOpenA
InternetConnectA
InternetReadFile
HttpOpenRequestA
InternetCloseHandle
InternetQueryOptionA
InternetSetOptionA
HttpQueryInfoA
Sections
.text Size: 368KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ