Static task
static1
Behavioral task
behavioral1
Sample
bd47ed090710a76676bf7c644b420159.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
bd47ed090710a76676bf7c644b420159.exe
Resource
win10v2004-20240226-en
General
-
Target
bd47ed090710a76676bf7c644b420159
-
Size
159KB
-
MD5
bd47ed090710a76676bf7c644b420159
-
SHA1
b2d651ee7746139336c0137b58dcbf7dc0a527fb
-
SHA256
5b3b089960aa44ccd652e768a7955a053a34687e06427755e2aa4faeb48705c0
-
SHA512
38d8e36c3808c460e5a7e643dca270f9a5b7a329fe37893b70e9d1868ed76eba9ed2ac0b7c8040304cd169f139280dfae58980570366497ebda65bda89b1d4dd
-
SSDEEP
3072:4FoaKkljYhRq7r7CsLtsMW9DdIJhN/QReJONrtl3BTNTUd7pWj2wY09bxOBDk7Vx:9kljYhRq7SsLtsMW9Dd+qeJONrt6d7ob
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd47ed090710a76676bf7c644b420159
Files
-
bd47ed090710a76676bf7c644b420159.exe windows:4 windows x86 arch:x86
374a8cffe6581e88a17b03259cb8a4ee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
StartServiceCtrlDispatcherA
kernel32
CloseHandle
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeConsole
GetCurrentProcessId
GetCurrentThreadId
GetFullPathNameA
GetLastError
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SearchPathA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
_chsize
_close
_ftime
_lseek
_open
_read
_stat
_strdup
_strnicmp
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_beginthreadex
_cexit
_iob
_isctype
_onexit
_pctype
_setmode
abort
atexit
atoi
calloc
ctime
fclose
fflush
fgets
fopen
fprintf
fputs
free
freopen
fseek
ftell
fwrite
gmtime
localtime
malloc
memcmp
memmove
mktime
perror
printf
rand
realloc
remove
rewind
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strerror
strncat
strrchr
strstr
strtok
system
time
tolower
toupper
vfprintf
odbc32
SQLAllocHandle
SQLConnect
SQLDisconnect
SQLExecDirect
SQLFreeHandle
SQLSetConnectAttr
SQLSetEnvAttr
user32
MessageBoxA
ws2_32
WSAGetLastError
WSASocketA
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE