Static task
static1
Behavioral task
behavioral1
Sample
c8e5b5b70a32069e63575f7d7d9cb452.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c8e5b5b70a32069e63575f7d7d9cb452.exe
Resource
win10v2004-20240226-en
General
-
Target
c8e5b5b70a32069e63575f7d7d9cb452
-
Size
50KB
-
MD5
c8e5b5b70a32069e63575f7d7d9cb452
-
SHA1
aa08fd764f6ba048177c6d89475683c9527023d1
-
SHA256
f8d9d4af36a791b5abf7c99fe35c5d2d243b5a132ad966f3a95414410ed5768b
-
SHA512
a69eb7691aaa3788a2c22aece20e480a4e231587d558d78af4def6bcfe26c4eebb0c3cb16223faef1a8806073cf28e8cbaf0199a598137e3ee6e88fc440708eb
-
SSDEEP
768:KgzUPEz6/zlevrUH91hPWA3ZbeLhhLVyKHYflCQj+kdhFK6MowJB:rUkUDd1oA3ZiLTLV/HAekdhEl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8e5b5b70a32069e63575f7d7d9cb452
Files
-
c8e5b5b70a32069e63575f7d7d9cb452.exe windows:1 windows x86 arch:x86
5898d8b74a596cff3f24b0fca836a5fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathA
ShellExecuteEx
ws2_32
htons
gethostname
gethostbyname
connect
closesocket
WSAStartup
WSACleanup
send
socket
WSAIoctl
advapi32
RegEnumKeyExA
StartServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenSCManagerA
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
DeleteService
CreateServiceA
CloseServiceHandle
AdjustTokenPrivileges
crypt32
CryptUnprotectData
gdi32
GetDeviceCaps
kernel32
Sleep
SetProcessPriorityBoost
WideCharToMultiByte
UnmapViewOfFile
lstrlenW
CloseHandle
lstrlen
lstrcpyn
lstrcpy
lstrcmpi
lstrcmp
lstrcat
SetPriorityClass
SetErrorMode
OpenProcess
MultiByteToWideChar
MapViewOfFile
LocalFree
LocalAlloc
LoadLibraryA
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetTickCount
GetTempPathA
GetSystemDirectoryA
GetShortPathNameA
GetProcAddress
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetModuleFileNameA
GetLogicalDrives
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
GetCurrentDirectoryA
GetComputerNameA
FindNextFileA
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
ExitProcess
DeleteFileA
CreateThread
CreateFileMappingA
CreateFileA
CopyFileA
WriteFile
ole32
CreateStreamOnHGlobal
CoTaskMemFree
psapi
GetModuleFileNameExA
EnumProcesses
EnumProcessModules
rasapi32
RasGetEntryPropertiesA
RasGetEntryDialParamsA
RasEnumEntriesA
shlwapi
StrChrA
PathFileExistsA
StrStrIA
StrRChrA
StrCmpNA
user32
GetDlgCtrlID
ReleaseDC
GetDC
FindWindowExA
SetActiveWindow
wsprintfA
FindWindowA
SendMessageA
wininet
InternetGetConnectedState
Sections
.text Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DarkCrpt Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ