Static task
static1
Behavioral task
behavioral1
Sample
c196331d56d7ad7f477a36b4c79bed93.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c196331d56d7ad7f477a36b4c79bed93.exe
Resource
win10v2004-20240226-en
General
-
Target
c196331d56d7ad7f477a36b4c79bed93
-
Size
126KB
-
MD5
c196331d56d7ad7f477a36b4c79bed93
-
SHA1
6270a48ec6a6fe0fefe3825a86bfc9686a714b41
-
SHA256
cb6f187436d67f3b09a314a2d701de85aaeee0446356d508b6989bc2c59315f3
-
SHA512
de4055ed0aa7e5e597fcc938cc0e5cb5713338d8b6621a8fe6caa71369162bc0e8cd8b1a8c153b241a5e30a791f47c326d5614ad78f3fb4b3ce03b8c2dfb109a
-
SSDEEP
3072:ZfJg5RUbqPN2N+h5Qc8gIbo28FMJ9p9x9Tqbv4T3bBMF0WwSxAQl:ZIxPQNCac8gqo28KJDNqbObBe0WjqQl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c196331d56d7ad7f477a36b4c79bed93
Files
-
c196331d56d7ad7f477a36b4c79bed93.exe windows:4 windows x86 arch:x86
17fce25816f606926f17af2f5fc0284e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AllocConsole
GetLogicalDrives
MulDiv
GetProcAddress
ResetEvent
GetVersion
MapViewOfFile
GetFileTime
GetWindowsDirectoryA
AddAtomA
VirtualQuery
GetSystemDirectoryA
OpenEventA
GlobalFindAtomA
SetErrorMode
GetCPInfo
CreateFileMappingA
ContinueDebugEvent
ReleaseSemaphore
PurgeComm
GetCommModemStatus
LocalShrink
HeapReAlloc
PostQueuedCompletionStatus
FlushFileBuffers
FindAtomA
GlobalSize
GetDiskFreeSpaceA
CancelIo
GetProcessTimes
GetConsoleOutputCP
GetFullPathNameA
GetPrivateProfileStringA
VirtualLock
LockFile
CreateMutexA
CallNamedPipeA
SetFileTime
InitAtomTable
GetLogicalDriveStringsA
GetSystemDefaultLangID
GetPriorityClass
GetProfileIntA
WaitForSingleObject
QueueUserAPC
CreateRemoteThread
MultiByteToWideChar
GetProfileSectionA
ReleaseMutex
GlobalWire
GetFileAttributesA
LocalUnlock
WaitForSingleObjectEx
CreateFileA
HeapCreate
GetThreadSelectorEntry
CreateConsoleScreenBuffer
VirtualProtect
GetVolumeInformationA
FindCloseChangeNotification
ClearCommBreak
GetProcessHeaps
GetProcessVersion
CreateDirectoryA
GlobalFree
IsValidCodePage
LoadLibraryA
GetCurrentProcess
VirtualAlloc
LocalCompact
IsBadStringPtrA
ResumeThread
IsBadCodePtr
IsBadHugeReadPtr
HeapFree
GetProcessWorkingSetSize
GetPrivateProfileStructA
GetProcessAffinityMask
DeviceIoControl
GetCommMask
GlobalHandle
GetHandleInformation
FreeLibrary
WaitForMultipleObjectsEx
DisconnectNamedPipe
SetLastError
WriteProfileSectionA
LockResource
LoadLibraryExA
BeginUpdateResourceA
SetFileAttributesA
FlushViewOfFile
GetProfileStringA
IsBadWritePtr
CopyFileA
GetProcessHeap
HeapAlloc
ReadProcessMemory
DefineDosDeviceA
GetLastError
LocalHandle
VirtualQueryEx
VirtualUnlock
GetTickCount
FindNextChangeNotification
GetFileSize
UnmapViewOfFile
GetEnvironmentStrings
GlobalAlloc
GetLargestConsoleWindowSize
GetCurrentProcessId
GetPrivateProfileSectionA
WaitForMultipleObjects
WriteProfileStringA
MoveFileExA
GetNamedPipeHandleStateA
QueryDosDeviceA
DeleteFiber
CreateMailslotA
GetCommandLineA
EndUpdateResourceA
UpdateResourceA
FlushInstructionCache
IsBadHugeWritePtr
SleepEx
GetModuleHandleA
UnlockFile
FormatMessageA
GetOEMCP
WritePrivateProfileStructA
FindClose
PulseEvent
ClearCommError
LocalFlags
GetLongPathNameA
SizeofResource
GetBinaryTypeA
DuplicateHandle
SearchPathA
GetStartupInfoA
msvcrt
time
__set_app_type
_controlfp
exit
strstr
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE