DotNetRuntimeDebugHeader
Static task
static1
Behavioral task
behavioral1
Sample
d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe
Resource
win10v2004-20240226-en
General
-
Target
d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22
-
Size
2.8MB
-
MD5
49246106665fa0fc369af394866827e3
-
SHA1
5e1fe81b007e03bb3a1b452e0cee53c87acafcf6
-
SHA256
d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22
-
SHA512
6b88ed92d28ea919ead1555c5edd040c74beafd52eae4caaa657f0f54ced97f6af448a68d5b51c5292697da8d543695447a4a0192014a4b4fdeae99550498497
-
SSDEEP
24576:R5RIyPhqQyjggWCghPaRoK/dq1mbexUjdrbdMM5696lGcl6tdqIGcEVM4b:R53PYXMgpCaRo4ngsdrbdMLQLw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22
Files
-
d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe windows:6 windows x64 arch:x64
4be9cf61fbea6eb1f9072ab06ecee6cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
EnumerateTraceGuidsEx
EventSetInformation
EventUnregister
EventActivityIdControl
EventRegister
EventWriteTransfer
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
EventWrite
EventEnabled
ncrypt
BCryptCloseAlgorithmProvider
BCryptEncrypt
BCryptDecrypt
BCryptImportKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptDestroyKey
BCryptGenRandom
kernel32
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
CreateProcessW
VirtualAllocEx
SetLastError
FormatMessageW
GetLastError
CloseHandle
GetExitCodeProcess
TerminateProcess
OpenProcess
K32EnumProcesses
GetProcessId
DuplicateHandle
GetCurrentProcess
GetCPInfoExW
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
WriteFile
WriteConsoleW
GetConsoleOutputCP
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
ResolveLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetTickCount64
GetCurrentProcessorNumber
GetCurrentThread
Sleep
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetProcAddress
RaiseFailFastException
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FreeLibrary
GetFileAttributesExW
GetSystemDirectoryW
LoadLibraryExW
SetThreadErrorMode
GetDynamicTimeZoneInformation
GetTimeZoneInformation
SetEvent
CreateEventExW
GetEnvironmentVariableW
GetThreadPriority
FlushProcessWriteBuffers
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
WaitForSingleObjectEx
VirtualQuery
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
ResetEvent
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
InitializeCriticalSectionAndSpinCount
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsFree
CompareStringW
LCMapStringW
CreateFileW
ole32
CoWaitForMultipleHandles
CoInitializeEx
CoUninitialize
CoGetApartmentType
user32
LoadStringW
Exports
Exports
Sections
.text Size: 562KB - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.managed Size: 1013KB - Virtual size: 1012KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 905KB - Virtual size: 905KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ