Static task
static1
Behavioral task
behavioral1
Sample
b951144aa3e2cce511c3ca94e9962252.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b951144aa3e2cce511c3ca94e9962252.exe
Resource
win10v2004-20240226-en
General
-
Target
b951144aa3e2cce511c3ca94e9962252
-
Size
56KB
-
MD5
b951144aa3e2cce511c3ca94e9962252
-
SHA1
a7601b9c221c4c3200b59992727864db7b25a487
-
SHA256
e22562a2d973fc26f3a8baa94bbb7eaf13cb2976fbe7766da9280e92a3a26890
-
SHA512
972ea61e05d597a8b297b92005add9a35de61560b697ebe0a3d30b0cda5bec7e65460591ab2733efa8feaf63068a5843164a6ee9329ef2b2b8a2edea70b1f4ad
-
SSDEEP
1536:r1GnW88+QNvpE/u0hox5rwX1VdpDUVs6C:0n18+wpE/6x5cX1VdpqC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b951144aa3e2cce511c3ca94e9962252
Files
-
b951144aa3e2cce511c3ca94e9962252.exe windows:4 windows x86 arch:x86
e261a7a3c688ea0be139b36c76ca8435
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
GetStartupInfoA
pk77
ord5687
ord7162
ord4891
ord8433
ord9098
ord4031
ord4042
ord2838
ord2934
ord7644
ord4573
ord6813
ord5330
ord4039
ord9922
ord5199
ord9979
ord1835
ord6319
ord10072
ord483
ord2931
ord397
ord8520
ord1324
ord9642
ord5971
ord338
ord2702
ord141
ord950
ord8188
ord6405
ord3011
ord8839
ord2131
ord2846
ord7746
ord3412
ord7238
ord6368
ord1768
ord4554
ord8895
ord7246
ord7762
ord1262
ord5482
ord1861
ord441
ord9482
ord8119
ord4619
ord8001
ord9199
ord7244
ord9349
ord5617
ord1577
ord7444
ord9614
ord5609
ord277
ord4218
ord9069
ord8546
ord9170
ord6239
ord1104
ord4411
ord584
ord437
ord5887
ord8835
ord9241
ord9225
ord6155
ord2929
ord736
ord730
ord9602
ord6489
ord82
ord6202
ord1725
ord4779
ord3148
ord8102
ord9433
ord8144
ord975
ord2627
ord9960
ord8950
ord8660
ord2013
ord547
ord7404
ord7142
ord2514
ord8615
ord913
ord5945
ord7003
ord5307
msvcr71
_controlfp
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
__CxxLongjmpUnwind
_setjmp3
_purecall
memcpy
_CxxThrowException
??2@YAPAXI@Z
strncmp
??3@YAXPAX@Z
__CxxFrameHandler
_onexit
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CONST Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
xdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
text Size: 1024B - Virtual size: 570B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_DATA Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ