Static task
static1
Behavioral task
behavioral1
Sample
cdbf585d844e574e463ca84713745c3b7f5727c9cf16713bd527c4c5c6cfb3cd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cdbf585d844e574e463ca84713745c3b7f5727c9cf16713bd527c4c5c6cfb3cd.exe
Resource
win10v2004-20240226-en
General
-
Target
cdbf585d844e574e463ca84713745c3b7f5727c9cf16713bd527c4c5c6cfb3cd
-
Size
196KB
-
MD5
28d934f0f858623fe7fb32e3414e0231
-
SHA1
27b1324ee883bc5e5b88edad17e2f9f3ec1b59ab
-
SHA256
cdbf585d844e574e463ca84713745c3b7f5727c9cf16713bd527c4c5c6cfb3cd
-
SHA512
4dbf8c48950d07c34acab8ad107b04be25b8857d5a69f26e47f5338ce47612add042892665b809660f67561262a1215765519979e33f5517acbf3e9b91b6bc5b
-
SSDEEP
6144:lJdzmtVw25Pk7q1T42UfgDfOVsBw98Ej0Rauv:lJdzmXwcx7UZp/ARnv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cdbf585d844e574e463ca84713745c3b7f5727c9cf16713bd527c4c5c6cfb3cd
Files
-
cdbf585d844e574e463ca84713745c3b7f5727c9cf16713bd527c4c5c6cfb3cd.exe windows:5 windows x86 arch:x86
f020e1a2feae651f7ce88318f285b500
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
user32
EndPaint
gdi32
BitBlt
advapi32
OpenProcessToken
shell32
ShellExecuteW
ws2_32
WSAStartup
Sections
.text Size: 72KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 11KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 79KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RSCW Size: 25KB - Virtual size: 28KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE