Static task
static1
Behavioral task
behavioral1
Sample
1cb64f7d8490acdda844f3d6114f0e8644a3b01c00467a4c319d3f766bc3129e.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1cb64f7d8490acdda844f3d6114f0e8644a3b01c00467a4c319d3f766bc3129e.exe
Resource
win10v2004-20240226-en
General
-
Target
1cb64f7d8490acdda844f3d6114f0e8644a3b01c00467a4c319d3f766bc3129e
-
Size
2.6MB
-
MD5
cd3f943f0370985e08413631763c6a3b
-
SHA1
d73108785d9a801df186059ccecb7bf9195da2f7
-
SHA256
1cb64f7d8490acdda844f3d6114f0e8644a3b01c00467a4c319d3f766bc3129e
-
SHA512
4a368a716d6ed2c634b3d8dfdedce35aff8bd3847d653a83bcf7879d5568b868dafba7f3a524a13b32c9d650467ddcca83cc37d0fc2ef24564772f02404d49af
-
SSDEEP
49152:uawQ0osq8eSuaR2m2gqvNOFvKl17pt/7e2rFMFUG21GiHB/:uGS7v0P/7lq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1cb64f7d8490acdda844f3d6114f0e8644a3b01c00467a4c319d3f766bc3129e
Files
-
1cb64f7d8490acdda844f3d6114f0e8644a3b01c00467a4c319d3f766bc3129e.exe windows:5 windows x86 arch:x86
0337d710dbf1334a18e8933cad268480
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASetLastError
gethostbyname
connect
WSAStartup
socket
htons
htonl
bind
listen
accept
closesocket
WSACleanup
ioctlsocket
recv
setsockopt
send
WSAGetLastError
kernel32
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
Sleep
GetCurrentDirectoryA
GetLastError
FindNextFileA
GetProcAddress
LoadLibraryA
FindFirstFileA
FreeLibrary
InterlockedExchange
CloseHandle
GetExitCodeThread
WaitForSingleObject
OpenThread
ExitThread
TerminateThread
CreateThread
OutputDebugStringA
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringW
GetSystemTime
GetSystemTimeAsFileTime
GetExitCodeProcess
ReadFile
PeekNamedPipe
CreateProcessW
CreatePipe
SystemTimeToFileTime
WriteFile
SetFilePointer
CompareStringW
CreateFileW
GetLocalTime
SetLastError
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedExchangeAdd
GetCurrentProcessId
QueryPerformanceCounter
DeleteFiber
SwitchToFiber
CreateFiber
GetModuleHandleW
GetVersion
GetFileType
GetStdHandle
ConvertFiberToThread
ConvertThreadToFiber
TerminateProcess
GetCurrentProcess
LoadLibraryW
FindNextFileW
FindFirstFileW
FindClose
GetConsoleMode
SetConsoleMode
ReadConsoleW
GetEnvironmentVariableW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
CreateFileA
SetEndOfFile
GetProcessHeap
GetFileSizeEx
ReadConsoleA
GetLocaleInfoA
GetFullPathNameA
SetStdHandle
FlushFileBuffers
GetConsoleCP
HeapFree
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCommandLineA
HeapReAlloc
ExitProcess
SetConsoleCtrlHandler
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
GetTickCount
GetModuleHandleA
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
ReportEventW
DeregisterEventSource
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegisterEventSourceW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 418KB - Virtual size: 418KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ