Static task
static1
Behavioral task
behavioral1
Sample
2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe
Resource
win10v2004-20240226-en
General
-
Target
2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8
-
Size
213KB
-
MD5
019b1c16d2d9003f04c2d7efa9917059
-
SHA1
dda80eda77dd345219bab319d4766602f9335699
-
SHA256
2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8
-
SHA512
e393e0f7d3a26a1013b873d41193e27b06e85565e6a8d613da854ab56dfb41df63eefa2e85c61fd933f7702728169e1f6650ec92c0ad2332dfc8c7f78780a247
-
SSDEEP
6144:p44b7czAEYdlyp6rswaDqKgL08qvFsRc2:m4fiQdlnoxgYlvy1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8
Files
-
2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe windows:4 windows x86 arch:x86
9c4846fa03a28c7bdcadc9a6c0ae1f66
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResetWriteWatch
SetComputerNameW
GetVolumeNameForVolumeMountPointW
SetNamedPipeHandleState
OpenThread
CallNamedPipeW
WriteFile
GlobalHandle
InitAtomTable
InitializeCriticalSectionAndSpinCount
CommConfigDialogA
SetFileApisToOEM
Process32Next
CompareStringA
VerifyVersionInfoW
lstrcmp
Sleep
FindCloseChangeNotification
SetThreadContext
OpenWaitableTimerW
GetConsoleAliasExesA
GlobalUnfix
GetVolumeInformationW
SetMailslotInfo
SetConsoleCursor
GetComputerNameA
AddAtomA
LoadLibraryW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetACP
CreateFileA
VirtualAlloc
GetCurrentThread
LoadLibraryA
GetProcAddress
GetOEMCP
user32
PostQuitMessage
DefWindowProcA
LoadCursorA
gdi32
DeleteEnhMetaFile
advapi32
RegOpenKeyW
Sections
.text Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 772B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ