Static task
static1
Behavioral task
behavioral1
Sample
c163c5fff9615424b8a1dbfde0dc329a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c163c5fff9615424b8a1dbfde0dc329a.exe
Resource
win10v2004-20240226-en
General
-
Target
c163c5fff9615424b8a1dbfde0dc329a
-
Size
12.1MB
-
MD5
c163c5fff9615424b8a1dbfde0dc329a
-
SHA1
e045c98159badcb81a0dfdc8981a588a283f0821
-
SHA256
8ed76e3af64f677f39df76e0bf60f8055bb41b6030683b1f297e1f545558aaec
-
SHA512
26dc31ac6a3ec9565eccfd32375db59b398b038e3777c0679fb4efb982e23f0975fa9506397432d052543a2de8ca723c2f82f5252ec6ab130e73a5a095e111fa
-
SSDEEP
6144:6LC75CORj5M52b9806i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6i6ii:62ps2bq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c163c5fff9615424b8a1dbfde0dc329a
Files
-
c163c5fff9615424b8a1dbfde0dc329a.exe windows:5 windows x86 arch:x86
34a3921456ca775499c3fcd8ff069ef5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetComputerNameA
CreateMutexW
SearchPathW
OpenFile
TlsGetValue
LocalCompact
LoadResource
ReadConsoleA
InterlockedDecrement
ScrollConsoleScreenBufferW
SetDefaultCommConfigW
WaitForSingleObject
_lclose
CreateNamedPipeW
GetSystemTimeAsFileTime
SetProcessPriorityBoost
ActivateActCtx
FindResourceExA
LoadLibraryW
GetConsoleMode
GetPrivateProfileStructW
SetSystemTimeAdjustment
SetConsoleMode
GetFileAttributesW
ReadFile
lstrcatA
CompareStringW
GetACP
lstrlenW
DisconnectNamedPipe
GetPrivateProfileIntW
ReleaseActCtx
GetLastError
IsDBCSLeadByteEx
GetProcAddress
GetTapeStatus
GetProcessHeaps
BeginUpdateResourceW
GetConsoleDisplayMode
GetLocalTime
LocalAlloc
BuildCommDCBAndTimeoutsW
AddAtomW
GetProfileStringA
VirtualLock
GetTapeParameters
WaitCommEvent
ContinueDebugEvent
FreeEnvironmentStringsW
WriteProfileStringW
VirtualProtect
GetConsoleCursorInfo
OpenSemaphoreW
GetVersionExA
FindActCtxSectionStringW
SuspendThread
lstrcpyW
CopyFileExA
GetModuleHandleA
GetModuleHandleW
Sleep
GetStartupInfoW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
GetLocaleInfoA
WideCharToMultiByte
HeapAlloc
VirtualAlloc
HeapReAlloc
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
RaiseException
user32
GetCursorPos
Sections
.text Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 737KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11.9MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ