Static task
static1
Behavioral task
behavioral1
Sample
de7eed9d8a1abfe2b24ae9c69af8c8c8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de7eed9d8a1abfe2b24ae9c69af8c8c8.exe
Resource
win10v2004-20240226-en
General
-
Target
de7eed9d8a1abfe2b24ae9c69af8c8c8
-
Size
227KB
-
MD5
de7eed9d8a1abfe2b24ae9c69af8c8c8
-
SHA1
79c0d39c5871f06fcee360d4aac4c68e69798ab8
-
SHA256
da985d2807db97309d9f9ca80ad42f1cb9d4099b924a4b03df4c00c0d35ed925
-
SHA512
429d5f00ea9b1053c5b6b69ca74f24e67d562c360a76e20c6346e1683d2187bd46ae51e67327d9b04987ede0dd81bc7b3375f85b14d5b833c183392e1b5a865e
-
SSDEEP
3072:SsUeb5x4VXJqklzrmfgpQPGi6k6JDgCB59+65rZLMW7ujDzVMZ/v9:MWuVluIuPGigV+6foWSj2Z/F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de7eed9d8a1abfe2b24ae9c69af8c8c8
Files
-
de7eed9d8a1abfe2b24ae9c69af8c8c8.exe windows:5 windows x86 arch:x86
969ccce559e4c79c6f01ec2b978a62f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
GetLastError
VirtualProtect
VirtualFree
FreeLibrary
LoadLibraryW
CloseHandle
CreateEventW
FreeResource
GetModuleHandleA
Sleep
GetProcAddress
FindResourceExW
GetStringTypeW
GetStringTypeA
VirtualAlloc
LockResource
LoadLibraryA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
GetCommandLineA
GetStartupInfoA
HeapFree
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
user32
UnregisterClassA
TranslateMessage
GetDesktopWindow
ole32
CoCreateInstance
CoUninitialize
CoInitialize
gdi32
SelectObject
CreateCompatibleDC
pdh
PdhGetCounterInfoW
PdhCollectQueryDataEx
PdhCollectQueryData
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 2KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE