Static task
static1
Behavioral task
behavioral1
Sample
b96948fb72b32b343d8b46343183487a45de5905b652e2abdb81dd310a7b771a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b96948fb72b32b343d8b46343183487a45de5905b652e2abdb81dd310a7b771a.exe
Resource
win10v2004-20240226-en
General
-
Target
b96948fb72b32b343d8b46343183487a45de5905b652e2abdb81dd310a7b771a
-
Size
139KB
-
MD5
20b7fa896735c76c0f3d44864d2040d4
-
SHA1
5c7d5ace342355e65af45bd642ad3915f4c36bb6
-
SHA256
b96948fb72b32b343d8b46343183487a45de5905b652e2abdb81dd310a7b771a
-
SHA512
7387943fa0c837f94b37d20d2811cac570cc77b5fc0595ec657fd92bab3a756ae84331fb933d55825a696e17a16a6fff1509eb8149ba58701fa0f44c22f86248
-
SSDEEP
3072:bbD2aKYF+M60FP6TO/yOFuE6dCOkz2FgC6uczaBkr:bn2aaMJ/lw2iTHU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b96948fb72b32b343d8b46343183487a45de5905b652e2abdb81dd310a7b771a
Files
-
b96948fb72b32b343d8b46343183487a45de5905b652e2abdb81dd310a7b771a.exe windows:4 windows x86 arch:x86
02fced34849eb2c3d6f45749ff570b52
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileA
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
LoadLibraryA
LocalAlloc
LocalFree
VirtualProtect
lstrcmpiA
FreeLibrary
shell32
SHGetFolderPathA
user32
GetDC
LoadAcceleratorsA
LoadCursorA
LoadIconA
RegisterClassW
ntdll
NtClose
NtOpenKey
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryValueKey
RtlAllocateHeap
RtlFreeHeap
RtlFreeUnicodeString
RtlInitUnicodeString
NtOpenFile
rpcrt4
RpcServerRegisterIf
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
StartServiceCtrlDispatcherA
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 117KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 301B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ydata Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE