Static task
static1
Behavioral task
behavioral1
Sample
e173c5ebe0381f689b2ce9b65c25982f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e173c5ebe0381f689b2ce9b65c25982f.exe
Resource
win10v2004-20240226-en
General
-
Target
e173c5ebe0381f689b2ce9b65c25982f
-
Size
560KB
-
MD5
e173c5ebe0381f689b2ce9b65c25982f
-
SHA1
a4d162778e1f09e9ccc5c6ea6e32394724981b74
-
SHA256
ddce9c2621b0ac554cb34d1eeaa146c060977173832277d42fd1ac8b0998d457
-
SHA512
217a3b3091038ccd9870c764adff01a1ea753367bed0da3cb17c3db5774b68b7f1ba72ee37d03a14b8d961db32d0da5e29290ad7c33ebcbf9e0d0736b656054f
-
SSDEEP
12288:bFNIHHO/8nryISwUMfnEUv7NAbXV+H5mfZM8z3hypWiIJlzB2N:bYQsLpUM/VxATcHE+8ThypWLlQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e173c5ebe0381f689b2ce9b65c25982f
Files
-
e173c5ebe0381f689b2ce9b65c25982f.exe windows:4 windows x86 arch:x86
f3bcdcd05e0a007b293c0c9d1266ecbf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetProcessHeap
GetVersion
ExitProcess
SetEndOfFile
GetFileType
InterlockedDecrement
VirtualFree
GlobalAlloc
HeapCreate
QueryPerformanceCounter
GetModuleFileNameA
TerminateProcess
GetModuleHandleW
GetStringTypeW
HeapReAlloc
GetACP
GetSystemDirectoryA
GetSystemTimeAsFileTime
CloseHandle
SetUnhandledExceptionFilter
GetModuleHandleA
GetFileAttributesA
CreateThread
FormatMessageA
GetCommandLineA
GetCPInfo
GetCommandLineW
SizeofResource
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
lstrlenW
LoadLibraryA
GetEnvironmentStringsW
GetTickCount
LCMapStringA
SetEvent
GetModuleFileNameW
FileTimeToSystemTime
LCMapStringW
EnterCriticalSection
HeapFree
FindFirstFileW
VirtualAlloc
user32
DestroyWindow
GetDlgItem
SendMessageA
IsWindowVisible
ReleaseDC
GetCursorPos
GetDC
PeekMessageA
GetWindowRect
IsWindow
SetWindowPos
PostQuitMessage
GetParent
Sections
.text Size: 472KB - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ