Static task
static1
Behavioral task
behavioral1
Sample
c6cd3704119a1204fdaecff55fe65fd3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6cd3704119a1204fdaecff55fe65fd3.exe
Resource
win10v2004-20231215-en
General
-
Target
c6cd3704119a1204fdaecff55fe65fd3
-
Size
728KB
-
MD5
c6cd3704119a1204fdaecff55fe65fd3
-
SHA1
aa8af9221e1e725cf186bdcc91cbfdaa2489d4f2
-
SHA256
bbff1cef59b01ac0952b124e1f3b243fce736244c24a03bd64ba9d5aefd677e5
-
SHA512
251fa57533150419873e1448f6e49798b93f8cd870d147530c09b8d4367694c4c157c70ba2683ca20adf817227fa852dd18596740efb3d8cf0f052daaf43ca8d
-
SSDEEP
12288:cY8/LXdY7DUoBALWWOrIjQtkkyQUWdUKo1nWjhStiSbUccDcIwsrgmz:b8/LG71ALWWOsgyidUKtYcwUccuA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6cd3704119a1204fdaecff55fe65fd3
Files
-
c6cd3704119a1204fdaecff55fe65fd3.exe windows:4 windows x86 arch:x86
55ce62830fe4bb1df26a016471312ec2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
FindNextFileA
WriteFile
CreateFileA
CloseHandle
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemTime
lstrcpyA
GetEnvironmentVariableA
lstrlenA
GetShortPathNameA
lstrcatA
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
VirtualAlloc
VirtualProtect
ExitProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
Module32Next
Module32First
lstrcmpA
GetModuleHandleA
CreateMutexA
Sleep
GetLastError
GetComputerNameA
GetModuleFileNameA
GetTempPathA
HeapAlloc
CopyFileA
SetEndOfFile
CreateFileW
GetLocaleInfoW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetModuleFileNameW
HeapValidate
DeleteFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
GetStartupInfoA
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
GetConsoleCP
GetConsoleMode
ReadFile
FlushFileBuffers
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
HeapReAlloc
HeapDestroy
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
advapi32
RegQueryValueA
OpenProcessToken
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
GetUserNameA
shell32
ShellExecuteA
SHGetFolderPathA
shlwapi
PathRemoveArgsA
PathUnquoteSpacesA
wininet
InternetOpenA
FtpPutFileA
InternetCloseHandle
FtpSetCurrentDirectoryA
InternetConnectA
Sections
.text Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 316KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ