Start
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240220-en
General
-
Target
file.exe
-
Size
6.9MB
-
MD5
0693515c29a762cbbd31e85f92e53340
-
SHA1
45d09330bb7d418113ab392e9e91eaedf02d9242
-
SHA256
4a90ecbed95c8c2539aa9b5b0f888337dde206b60cb3a03e2a1d7025ba928153
-
SHA512
643e0303d6e7f6f1359e07c5a78352115dd1acd98ee57530d7d55ba9bf8a46b4a29f1f8924f6425f3e9c450495808c2a3dcc0248fc40507193a790079fe3f78d
-
SSDEEP
98304:18LUmJdYqUXScfTVSj9wI+IKhEJmlznz2ZeBPaI8fjxHzKvCpA01d0Jmc4aThyuR:f7XSq3IpReb90fjxyC7YCmh3UMGV7ED
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:6 windows x86 arch:x86
ba4ce0cbe832b3560bbc7a0c6d1fe182
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
wsprintfA
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateCompatibleBitmap
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoInitialize
ws2_32
WSAStartup
crypt32
CryptUnprotectData
shlwapi
PathFindExtensionA
gdiplus
GdipGetImageEncoders
setupapi
SetupDiEnumDeviceInfo
ntdll
RtlUnicodeStringToAnsiString
rstrtmgr
RmStartSession
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp(‹ Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp(‹ Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp¯#@ Size: - Virtual size: 1007KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp¯#@ Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp¯#@ Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 814KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ