Static task
static1
Behavioral task
behavioral1
Sample
bec677ea679791ad6376a1575710ef4c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bec677ea679791ad6376a1575710ef4c.exe
Resource
win10v2004-20240226-en
General
-
Target
bec677ea679791ad6376a1575710ef4c
-
Size
40KB
-
MD5
bec677ea679791ad6376a1575710ef4c
-
SHA1
825d220edf9e5855029538f24920f2447f59519d
-
SHA256
f37e4164413233a469aed1a55625130539378377a228b6939cd690f2b15b19c6
-
SHA512
2316e3829c5c24b5196c072260f7f743583ef627bc17afd9ad9612e5b8963fa7022764797c33f82a39676cde596b2c6fef517e8a47844c1f2523e4ce36c15549
-
SSDEEP
384:33Rw9vgogupg9n5lroFbvKx7CzZ44Ufg9N7J7d3yQcvn2+joHty:33qSDWG5lroNvKkq4Mg335QndjoN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bec677ea679791ad6376a1575710ef4c
Files
-
bec677ea679791ad6376a1575710ef4c.exe windows:4 windows x86 arch:x86
73f36b79801b0b94f58236ef3c3373d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
CreateToolhelp32Snapshot
lstrlenA
OpenProcess
GetSystemDirectoryA
Sleep
Process32First
Process32Next
VirtualAllocEx
GetCurrentProcess
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
GetStringTypeA
GetStringTypeW
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
LoadLibraryA
GetLastError
FlushFileBuffers
SetFilePointer
SetStdHandle
CloseHandle
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE