Static task
static1
Behavioral task
behavioral1
Sample
e1e8aa043783be3bdc8997458cfde40a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1e8aa043783be3bdc8997458cfde40a.exe
Resource
win10v2004-20240226-en
General
-
Target
e1e8aa043783be3bdc8997458cfde40a
-
Size
395KB
-
MD5
e1e8aa043783be3bdc8997458cfde40a
-
SHA1
dbcaafb83b1a81f05c6bbc512e6b644616628755
-
SHA256
129c1bbc31960147edd64cb3bfde9bde1f8dd993593642115654b08f71f2f59c
-
SHA512
2e707cd00037e0ded25bf9449114597972796c6b463266ce071ff5622c2c731817d3093eb773f37f04b2e2ac4ed68a6a51fefc1c55ebc4e32ae86f15072472d1
-
SSDEEP
3072:0ZQL8MeeohhGHn4DF6GBNk4y/e0tLEcJ4st2PJPAnCM2p9GrqpqduF5d:0ZpjBhhG4FpxCtLZP2i5kzWuF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1e8aa043783be3bdc8997458cfde40a
Files
-
e1e8aa043783be3bdc8997458cfde40a.exe windows:5 windows x86 arch:x86
c826ab8a89f306aea5640554e31fba60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileTime
GetFileType
GetLastError
GetLocaleInfoW
GetLogicalDriveStringsW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemDefaultUILanguage
GetSystemDirectoryW
GetSystemTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetUserDefaultLCID
GetVersionExW
GetVolumeInformationW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
GetCurrentProcess
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
MulDiv
MultiByteToWideChar
OpenProcess
OutputDebugStringW
PeekNamedPipe
Process32FirstW
Process32NextW
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleOutputCharacterA
ReadFile
ResumeThread
RtlUnwind
SetConsoleCursorPosition
SetCurrentDirectoryW
SetErrorMode
SetEvent
SetFileAttributesW
SetLastError
SetNamedPipeHandleState
SetThreadPriority
SetVolumeLabelW
Sleep
TerminateProcess
TlsSetValue
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
GetConsoleScreenBufferInfo
GetCommandLineW
GetACP
FreeLibrary
FreeConsole
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
FillConsoleOutputCharacterW
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitProcess
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateToolhelp32Snapshot
CreateThread
CreateProcessW
CreatePipe
CreateMutexW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
CloseHandle
GetModuleHandleW
IsValidLocale
VirtualAlloc
user32
OffsetRect
OpenClipboard
RegisterClipboardFormatW
ReleaseDC
SetForegroundWindow
SetRectEmpty
SetWindowLongW
SetWindowPos
ShowWindow
SystemParametersInfoW
UnregisterClassW
UpdateWindow
wsprintfW
GetWindowThreadProcessId
GetWindowLongW
GetSystemMenu
GetKeyState
GetDC
GetClipboardFormatNameW
GetClipboardData
EndDeferWindowPos
EnableWindow
EmptyClipboard
DrawStateW
DrawIconEx
DrawFrameControl
DrawFocusRect
DestroyCursor
ChildWindowFromPoint
BringWindowToTop
AttachThreadInput
AppendMenuW
GetTopWindow
EndMenu
CloseClipboard
CreateMenu
GetClipboardSequenceNumber
CountClipboardFormats
GetCapture
GetForegroundWindow
AnyPopup
GetDialogBaseUnits
GetFocus
LoadIconW
IsWindowVisible
gdi32
WidenPath
SwapBuffers
CreateMetaFileA
StrokePath
advapi32
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegSetValueExW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
AccessCheck
AddAccessAllowedAce
AllocateAndInitializeSid
DuplicateToken
FreeSid
GetLengthSid
GetUserNameW
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
OpenProcessToken
OpenThreadToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumKeyW
RegEnumValueW
SetSecurityDescriptorOwner
Sections
.text Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ