Static task
static1
Behavioral task
behavioral1
Sample
c3566e39198ef6a5b2da0008278af798.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c3566e39198ef6a5b2da0008278af798.exe
Resource
win10v2004-20240226-en
General
-
Target
c3566e39198ef6a5b2da0008278af798
-
Size
132KB
-
MD5
c3566e39198ef6a5b2da0008278af798
-
SHA1
8fd0386ac80946cdfd16b6409130cfdb5b904c0e
-
SHA256
dc1f3accc9279bfb275246b9837aea4c06398c30f337c0fd4d2fefb4baded23e
-
SHA512
bf4a1a35f9eb7a9b458a47225726085437a0ccca4ae64a27c1b741159eda5f6d1997933291b1e339e50618e4d02448d018fc962c87a544dac49be88ba4c9bf34
-
SSDEEP
3072:sFqlWhVihRTyCckXklVCAL39MFqWDa5jtqS:3lBhFHaJLNmqN5j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3566e39198ef6a5b2da0008278af798
Files
-
c3566e39198ef6a5b2da0008278af798.exe windows:4 windows x86 arch:x86
d41b19be34e6d1dd99866806800964b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQuery
DefineDosDeviceA
RtlMoveMemory
IsDBCSLeadByteEx
ResetEvent
GetLocaleInfoA
GetComputerNameA
GetBinaryTypeA
CopyFileExA
FreeEnvironmentStringsA
GetCommandLineA
ExitProcess
GetStartupInfoA
Sections
PESEC0 Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PESEC1 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
idata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ