Static task
static1
Behavioral task
behavioral1
Sample
ad487dd396b2d7f3af944e1d6f810fef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad487dd396b2d7f3af944e1d6f810fef.exe
Resource
win10v2004-20240226-en
General
-
Target
ad487dd396b2d7f3af944e1d6f810fef
-
Size
11.1MB
-
MD5
ad487dd396b2d7f3af944e1d6f810fef
-
SHA1
bc2c0918679271ddbe2d23443058f5280ba8b740
-
SHA256
129f7b038f375b7e2e61bbe37644e35ec995e3a291163617ac990eb644ddde5d
-
SHA512
e70ad5fd9bbe4982934bcba4aea734bca85f723bb1d55cf911bf1ed7b115d945d2fef351f091869dc8e71a3d980c0c5ceb7ab8706291ceeb9654dbbbcf3370fe
-
SSDEEP
1536:agrtnQ0lULhZotkxdIvblp95RdfSYQnp9EI8JH+PhN06iWWzBWzBWzBWzBWzBWzX:M0lULRxdIjr9bEYQfWePhN06
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad487dd396b2d7f3af944e1d6f810fef
Files
-
ad487dd396b2d7f3af944e1d6f810fef.exe windows:5 windows x86 arch:x86
816e07d7c149d21a4d07bdee1ab5223a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comsvcs
CoCreateActivity
RecycleSurrogate
advapi32
RegCreateKeyExA
CryptSignHashW
RegSaveKeyA
InitializeAcl
GetUserNameA
RegOpenKeyW
RegDeleteValueW
RegRestoreKeyA
ReadEventLogA
OpenEventLogW
RegEnumKeyA
authz
AuthzFreeContext
AuthzInitializeContextFromSid
AuthzAddSidsToContext
AuthzFreeAuditEvent
AuthzFreeResourceManager
clbcatq
CoRegCleanup
ComPlusMigrate
SetSetupSave
kernel32
AllocConsole
CreateFileW
ExitProcess
VirtualAllocEx
WaitForSingleObject
OpenEventA
LoadLibraryA
LoadLibraryExW
FindClose
GetACP
WriteFile
SetCurrentDirectoryA
GetFileAttributesW
VirtualQuery
GetCurrentDirectoryA
OpenSemaphoreA
GetVolumeNameForVolumeMountPointA
CreateJobObjectW
clusapi
CloseCluster
CloseClusterGroup
CloseClusterNode
ClusterControl
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.odata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.relo� Size: 10.9MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ