Static task
static1
Behavioral task
behavioral1
Sample
ad97b811e47d06d943d887225394a497.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad97b811e47d06d943d887225394a497.exe
Resource
win10v2004-20240226-en
General
-
Target
ad97b811e47d06d943d887225394a497
-
Size
24KB
-
MD5
ad97b811e47d06d943d887225394a497
-
SHA1
4ee2d4355ee4936ccda7776bfc883b9aeed5c233
-
SHA256
e5f8012bfe43c02ebb28791eccc83c10460a39494ca728e0a299c3e92b759204
-
SHA512
4e209346c56f515071d555b2fdefc77d11b9f17f64f8f47fa25001996277689ac0f7e40f155c8fe0a085f98536ea65097d27189afbbfb65e9a380f3932ef1286
-
SSDEEP
384:3i6iq6ux51QTiKaWfabIocme3NtdEOqVA1pNglJbV6w:SfY1CizbNvUKOqgNg1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad97b811e47d06d943d887225394a497
Files
-
ad97b811e47d06d943d887225394a497.exe windows:4 windows x86 arch:x86
b71111ded7b1870e5c842d72dca81456
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
CStdStubBuffer_AddRef
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrOleAllocate
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy
CStdStubBuffer_QueryInterface
NdrStubCall2
NdrDllCanUnloadNow
CStdStubBuffer_CountRefs
CStdStubBuffer_Disconnect
IUnknown_Release_Proxy
CStdStubBuffer_Connect
NdrOleFree
NdrDllRegisterProxy
NdrStubForwardingFunction
NdrCStdStubBuffer2_Release
mpr
WNetEnumResourceA
kernel32
Sleep
ntdll
NtAllocateVirtualMemory
msvcrt
_initterm
free
malloc
_adjust_fdiv
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ