time
Static task
static1
Behavioral task
behavioral1
Sample
c1f6ee75b679ca48244ddedaa4988cd2.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c1f6ee75b679ca48244ddedaa4988cd2.exe
Resource
win10v2004-20240226-en
General
-
Target
c1f6ee75b679ca48244ddedaa4988cd2
-
Size
64KB
-
MD5
c1f6ee75b679ca48244ddedaa4988cd2
-
SHA1
589960be553a0fa85be95d032875081188a22445
-
SHA256
e154450a7cdbf316d61226bdd1cafb7606de7c4032fbd5d3d24c7d6e03652cca
-
SHA512
217094c6d71c233b3ff8aacfcf11d87539032fe28512eacb3ff44323f8b0726f129c153f52fa3d64aac919fa5c6756145d0f142e88367f947a61b3091d1f8095
-
SSDEEP
768:zwjNw9LpufWmydYANuIZz0Jo9KpRrLq3nm0vzeZyMbeN/R/LZ+U1D4N8jUD00k8G:zwJw9Lp3pV0+EankW/H42S00/G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1f6ee75b679ca48244ddedaa4988cd2
Files
-
c1f6ee75b679ca48244ddedaa4988cd2.exe windows:4 windows x86 arch:x86
d524eab59fefcb2922aff9eabf31fb8f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
closesocket
WSAStartup
bind
listen
accept
inet_addr
gethostbyname
socket
setsockopt
htons
recv
connect
WSAGetLastError
shutdown
select
__WSAFDIsSet
send
inet_ntoa
kernel32
DeleteCriticalSection
GetCommandLineA
GlobalAlloc
CreateMutexA
CopyFileA
InitializeCriticalSection
CreateThread
ExitThread
Sleep
WaitForSingleObject
GetLastError
GetCurrentProcessId
GetTickCount
GetCurrentProcess
TerminateThread
GetCurrentThread
GetVersion
GetCurrentThreadId
GetProcessHeap
advapi32
RegCloseKey
RegCreateKeyExA
RegEnumValueA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
msvcrt
strlen
strcat
rand
realloc
atoi
strchr
strstr
strcpy
_snprintf
free
gmtime
malloc
_time64
_spawnl
sscanf
strncpy
srand
strtok
strrchr
sprintf
exit
_fullpath
_execl
fwrite
fclose
fread
_filelength
fopen
strncmp
isdigit
_strrev
Exports
Exports
Sections
.text Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE