Static task
static1
Behavioral task
behavioral1
Sample
c1e92e04cdb432d83ea2610ef226d4cd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c1e92e04cdb432d83ea2610ef226d4cd.exe
Resource
win10v2004-20240226-en
General
-
Target
c1e92e04cdb432d83ea2610ef226d4cd
-
Size
88KB
-
MD5
c1e92e04cdb432d83ea2610ef226d4cd
-
SHA1
e4e7e08a0d9af872567a9feb89c685c2f523bf24
-
SHA256
fb4cbfacfee766c8579a157c5732a70d5fb55254264a2f2f431d2bc6e1fdd46b
-
SHA512
1ad8f73b082af6dfe15bc039d3ab85c5c9627fb2b9ec16ece87de8996574f8fabc9fed0d18b101dd323975014488653ce9639716259dc991bd5a0a84e632520a
-
SSDEEP
1536:/E/fUvr4A5Nri/dEbr1yqsmU7n2FRog5B:/E/s4aNrYqr1yBzGog
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1e92e04cdb432d83ea2610ef226d4cd
Files
-
c1e92e04cdb432d83ea2610ef226d4cd.exe windows:4 windows x86 arch:x86
7324b889a4dda41c9d0ef9e000c5373d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
DisconnectNamedPipe
TerminateProcess
WaitForMultipleObjects
TerminateThread
GetLastError
CreateThread
CreatePipe
CreateProcessA
DuplicateHandle
GetCurrentProcess
ExitThread
Sleep
ReadFile
PeekNamedPipe
WriteFile
GetStdHandle
FreeConsole
GetStartupInfoA
WideCharToMultiByte
LCMapStringA
SetEndOfFile
LCMapStringW
CreateFileA
GetNumberOfConsoleInputEvents
WriteConsoleA
GetConsoleMode
SetConsoleMode
PeekConsoleInputA
HeapReAlloc
LoadLibraryA
ReadConsoleInputA
GetStringTypeW
GetStringTypeA
GetProcAddress
SetStdHandle
SetEnvironmentVariableA
SetFilePointer
CompareStringA
GetOEMCP
CompareStringW
GetCPInfo
GetEnvironmentStringsW
GetACP
HeapFree
HeapAlloc
CloseHandle
Beep
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
SetHandleCount
GetFileType
RtlUnwind
FlushFileBuffers
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStrings
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
wsock32
__WSAFDIsSet
getsockname
select
listen
WSASetLastError
recvfrom
accept
bind
socket
setsockopt
getservbyport
connect
htons
ioctlsocket
ntohs
getservbyname
gethostbyaddr
gethostbyname
inet_addr
WSACleanup
WSAGetLastError
WSAStartup
closesocket
recv
send
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ