Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
General
-
Target
file.exe
-
Size
6.6MB
-
MD5
d276869a424e8823dd9fd3655146d6d3
-
SHA1
a3adec098744a1692c634114b16caa3f42729e15
-
SHA256
c5206321d935023b18c49c9620c2fe6b57c8ed6121bf31b2d62c7c08a05a84e9
-
SHA512
48394f7e82f9f624285ea673436648e2e86d29a54fc482146f195423db40f28a02c2da7487f8f1863d7d7743f963e9c4d2a591f8c4066651a6bbdfedfdd1583b
-
SSDEEP
196608:JJ+iDPPTOfVlonMH/RU+QxYL/x5AYOUlFM7:JJLLydlokYyx5XOUA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:6 windows x86 arch:x86
23fed147ee36eec71d9dd79b6ff34036
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
wsprintfA
GetProcessWindowStation
GetProcessWindowStation
gdi32
CreateCompatibleBitmap
advapi32
CredEnumerateA
shell32
ShellExecuteA
ole32
CoInitializeEx
ws2_32
WSAStartup
crypt32
CryptUnprotectData
shlwapi
PathFindExtensionA
gdiplus
GdiplusStartup
setupapi
SetupDiEnumDeviceInterfaces
ntdll
RtlUnicodeStringToAnsiString
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp�@ Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp�@ Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp÷�� Size: - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp÷�� Size: 1024B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp÷�� Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ