Static task
static1
Behavioral task
behavioral1
Sample
be18868d884bfe741e4bf2776128f4e5.exe
Resource
win7-20240221-en
General
-
Target
be18868d884bfe741e4bf2776128f4e5
-
Size
128KB
-
MD5
be18868d884bfe741e4bf2776128f4e5
-
SHA1
7878f78514937f758e51b307ded6c0c5cadf7eeb
-
SHA256
e1c888c6584bb55b4cc7f107bd9bbcc593191acc22067e18489435952ee6b635
-
SHA512
26b0e39dc66f39d393b789f2a8b2663bd250dcc40dcf3bfef30635e46a452468b58552c552912ecf43bc045e9ff8dc70bc015a2ec9d2a58a3461d9a8298fd776
-
SSDEEP
3072:diOpGhEasd+/+5iu/i++jUZT75ZRyHho:d9pGSal25XI+D4Hh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be18868d884bfe741e4bf2776128f4e5
Files
-
be18868d884bfe741e4bf2776128f4e5.exe windows:4 windows x86 arch:x86
4dbd995e70970f5faf922393c4fff1ef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strncpy
_ftol
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
srand
rand
strrchr
shell32
ShellExecuteA
kernel32
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetModuleFileNameA
WinExec
lstrcpyn
RtlMoveMemory
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
WriteFile
CreateFileA
GetEnvironmentVariableA
user32
MessageBoxA
CallWindowProcA
wsprintfA
shlwapi
PathFileExistsA
advapi32
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ