Static task
static1
Behavioral task
behavioral1
Sample
de266d98237a49750c9fba40af5379ab.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
de266d98237a49750c9fba40af5379ab.exe
Resource
win10v2004-20240226-en
General
-
Target
de266d98237a49750c9fba40af5379ab
-
Size
457KB
-
MD5
de266d98237a49750c9fba40af5379ab
-
SHA1
613de89cf482e448aa04dacfd513e41a07935d1c
-
SHA256
bacbdc47bc9db06ae7de4632e8fc182f54aa98c5633f249ee11f5068f858934d
-
SHA512
207497d2c963921d056867d9fee75618a8a3fcfbefd6dadbe6b1c760f7cff0803c1bc190907d6df5e8d660ead1dbb1ed8aa033bb511745a8e7c8af998263aa4d
-
SSDEEP
6144:WOKYF5S/W3Q4FPU7zISFBT6zefEdEg28ALohinUMXKLw:1KYFpQV7t56KfLoPLw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de266d98237a49750c9fba40af5379ab
Files
-
de266d98237a49750c9fba40af5379ab.exe windows:6 windows x64 arch:x64
649c73417efa16940e341e291b80897c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantClear
ws2_32
WSAGetLastError
freeaddrinfo
recv
connect
socket
send
WSAStartup
getaddrinfo
closesocket
WSACleanup
kernel32
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetShortPathNameW
GetModuleFileNameW
GetEnvironmentVariableW
LoadLibraryA
lstrcatW
GetProcAddress
ExitProcess
lstrcpyW
IsDebuggerPresent
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CloseHandle
GetLastError
DeviceIoControl
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
WideCharToMultiByte
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentThreadId
InitializeCriticalSectionEx
RtlUnwind
GetSystemTimeAsFileTime
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetCurrentProcess
TerminateProcess
GetLocaleInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
HeapAlloc
HeapFree
LCMapStringW
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ