Static task
static1
Behavioral task
behavioral1
Sample
052a80f8f91ab02614783eaad85d249ea1edf34b74caba870ad6f4501e899f2f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
052a80f8f91ab02614783eaad85d249ea1edf34b74caba870ad6f4501e899f2f.exe
Resource
win10v2004-20240226-en
General
-
Target
052a80f8f91ab02614783eaad85d249ea1edf34b74caba870ad6f4501e899f2f
-
Size
107KB
-
MD5
c67486bc5207d1eb696c37b0726ca7be
-
SHA1
6ac38f6233982dea0acfa5d71eef7fc252f4d029
-
SHA256
052a80f8f91ab02614783eaad85d249ea1edf34b74caba870ad6f4501e899f2f
-
SHA512
84d123275c654502d71f764c57d3318fdfdcefa001b5d9ade9417ecb5608b35099f025726ad9e0dac47cd321595065fc3a848c10d905d6b2676b4f4fb49fd571
-
SSDEEP
3072:pt/ubpNvzCEqTaUZ9GpnJ41g6CXYCN3BHbf84VwX:j/ubzbCNcP46dXNHbfO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 052a80f8f91ab02614783eaad85d249ea1edf34b74caba870ad6f4501e899f2f
Files
-
052a80f8f91ab02614783eaad85d249ea1edf34b74caba870ad6f4501e899f2f.exe windows:4 windows x86 arch:x86
cecb1d580b4a2c84f8d66e29b2540a79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetDC
GetDesktopWindow
CharNextA
GetParent
TranslateMessage
GetSystemMetrics
gdi32
CreatePen
SaveDC
GetPixel
GetObjectA
SetMapMode
CreateFontIndirectA
SetTextAlign
CreatePalette
DeleteDC
GetStockObject
CreateCompatibleDC
RestoreDC
SelectPalette
GetTextMetricsA
GetClipBox
SetStretchBltMode
PatBlt
LineTo
SelectObject
DeleteObject
RectVisible
CreateSolidBrush
SetTextColor
GetDeviceCaps
GetNearestPaletteIndex
kernel32
GetACP
lstrlenW
QueryPerformanceCounter
DeleteFileA
GetOEMCP
GetDriveTypeA
GetModuleHandleA
IsDebuggerPresent
GetCurrentProcessId
lstrcmpiW
SetCurrentDirectoryA
lstrcmpiA
GetWindowsDirectoryA
VirtualAlloc
GlobalFindAtomA
GlobalFindAtomW
GetVersion
GetTickCount
GetCommandLineA
lstrlenA
GetCurrentThread
GetModuleHandleW
GetCommandLineW
lstrcmpA
MulDiv
GetCurrentProcess
GetConsoleOutputCP
GetStartupInfoA
GetThreadLocale
DeleteFileW
RemoveDirectoryA
GetCurrentThreadId
RemoveDirectoryW
ExitProcess
CopyFileA
GetProcessHeap
glu32
gluQuadricCallback
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE