Static task
static1
Behavioral task
behavioral1
Sample
b.exe
Resource
win7-20240221-en
General
-
Target
b.exe
-
Size
36KB
-
MD5
e4e1c415f8b4378524b4e48a496844e0
-
SHA1
d14520492e7ded5d70595cdbfa77ad2b7ba05675
-
SHA256
695f62e7c12fcece62f14d6b43b46677b954679d1277cfab68b138caf5aca0fc
-
SHA512
a9b9ae8eb2d1f03f9c6531ae73acbcdd13e35cbf1814f66fe321fb6623943239977c2cb4a90f0e7b57615c929776c08288247e44857902160b78e8673b00e45f
-
SSDEEP
768:+NnmZ/8vPlLUdhfJ8v6utFpVsuRregrWChgzpXb7Dsr1:wnwu4DejVLyOhgzpXYr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b.exe
Files
-
b.exe.exe windows:4 windows x86 arch:x86
d01b793cfeabb1210a9dfd924e5cbf0d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
SendInput
gdi32
DeleteDC
advapi32
RegCloseKey
shell32
ExtractIconA
msvcp60
??0_Winit@std@@QAE@XZ
msvcrt
_iob
winmm
waveInOpen
shlwapi
PathFileExistsA
ws2_32
htons
urlmon
URLDownloadToFileA
gdiplus
GdipFree
wininet
InternetOpenA
Sections
.MPRESS1 Size: 28KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE