Static task
static1
Behavioral task
behavioral1
Sample
c3d1605577c9532e7df1ae8abaa40f98.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c3d1605577c9532e7df1ae8abaa40f98.exe
Resource
win10v2004-20240226-en
General
-
Target
c3d1605577c9532e7df1ae8abaa40f98
-
Size
65KB
-
MD5
c3d1605577c9532e7df1ae8abaa40f98
-
SHA1
9d0f4ef990de42996348d543b33170a5ba145133
-
SHA256
712791550613ba2ca2250235b71ff83faff48be0834f2888823cc788467dbccd
-
SHA512
58e40d202e60a777241d38582c878f0232bdd7e3a9dd307ecd3ba552dcd1f1b653dd94de987386ff815198753c55bc9c6ca443c3352a1be71747397a13aade67
-
SSDEEP
768:7LKfykYCD9/or4eMKv8hlOKIUR+dDgEDxDphWtNKIn+M7oQtt:7VkzQrzKrIUIjDxDzWJ+Wt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3d1605577c9532e7df1ae8abaa40f98
Files
-
c3d1605577c9532e7df1ae8abaa40f98.exe windows:4 windows x86 arch:x86
6aaa5e7d64f9089a673353f7fb4dc507
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyW
RegFlushKey
RegCreateKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyA
RegLoadKeyW
RegReplaceKeyW
RegEnumValueA
RegLoadKeyA
RegOpenKeyExA
RegOpenKeyExW
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueA
RegDeleteKeyW
RegEnumKeyW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyA
RegLoadKeyW
RegQueryValueW
RegEnumKeyA
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueA
RegReplaceKeyW
RegFlushKey
RegEnumValueA
RegQueryInfoKeyW
RegGetKeySecurity
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyA
RegCreateKeyW
RegEnumKeyExA
RegQueryValueExW
RegLoadKeyA
RegEnumValueW
RegDeleteValueA
kernel32
FreeResource
lstrcmpA
FreeResource
GetFileType
FreeResource
lstrcmpiA
FreeResource
lstrcatA
FreeResource
FindAtomW
FreeResource
GetCurrentProcessId
FreeResource
GetFileAttributesA
FreeResource
WideCharToMultiByte
FreeResource
HeapAlloc
lstrcmpA
GetLastError
GetModuleFileNameA
HeapFree
GlobalAlloc
GlobalFlags
GlobalFindAtomA
HeapAlloc
GlobalFree
GetLocalTime
GlobalFindAtomW
FindAtomW
GetCurrentProcess
WideCharToMultiByte
GetModuleHandleA
GetFileSize
GetConsoleCursorInfo
GetModuleFileNameA
WideCharToMultiByte
FreeResource
lstrcatA
GetFileAttributesA
HeapFree
GetModuleHandleA
FreeLibrary
GetFileSize
lstrcmpiA
GetFileType
GlobalFree
GlobalFindAtomA
GetStringTypeA
GlobalAlloc
GetLocalTime
HeapAlloc
GetCurrentProcessId
Sections
.tadt Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.init Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eddta Size: 10KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.iaaaa Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ