Static task
static1
Behavioral task
behavioral1
Sample
b6ba1a154657de016f26e81cd8472dc4.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b6ba1a154657de016f26e81cd8472dc4.exe
Resource
win10v2004-20240226-en
General
-
Target
b6ba1a154657de016f26e81cd8472dc4
-
Size
257KB
-
MD5
b6ba1a154657de016f26e81cd8472dc4
-
SHA1
6aaa162beed095e5469df079445fc9176a548acc
-
SHA256
dcc7d84517a9f0899130f63ee97d7ed576120174598cc6c2768228d81881bf09
-
SHA512
c8eb47d6dd5f04f5d7a75f83ec5f746c3476bc3dd41f5111296d2f1cae9c1a0333089d69483fc80872ad2face3d8f2ff588ad89e444841bdc359b9b7039340d0
-
SSDEEP
3072:KNPFEwD5d/TfC24w4utuOPGBu+JDsHhBowlzfP7iQfzuvTdT6+DH3asqEAGKriyD:sPV7624wZ0OuBuAMwY7icz83/4iyV5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6ba1a154657de016f26e81cd8472dc4
Files
-
b6ba1a154657de016f26e81cd8472dc4.exe windows:5 windows x86 arch:x86
290e63d6e4458a7b727b932a59204015
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
VirtualProtect
VirtualFree
Sleep
FreeLibrary
LoadLibraryW
CloseHandle
GetModuleHandleA
LockResource
FindResourceExW
CreateEventW
FreeResource
LocalAlloc
GlobalFree
WriteFile
CreateFileW
GlobalAlloc
LoadResource
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetProcAddress
VirtualAlloc
LoadLibraryA
ExitProcess
InitializeCriticalSectionAndSpinCount
RtlUnwind
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
HeapFree
SetUnhandledExceptionFilter
GetModuleHandleW
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
user32
RegisterClassA
BringWindowToTop
ReleaseDC
GetClientRect
FillRect
GetDC
PostMessageA
DispatchMessageA
UnregisterClassA
PeekMessageA
TranslateMessage
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantInit
VariantClear
gdi32
GetObjectW
CreateCompatibleDC
SelectObject
GetDIBits
pdh
PdhEnumObjectItemsHW
PdhConnectMachineW
PdhCollectQueryData
PdhGetCounterInfoW
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 169KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.imul Size: 2KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE