Static task
static1
Behavioral task
behavioral1
Sample
321301950c449ed3bd6f1e08a93e401bc5bfc74cb63036dbce111b5f0cd5d6ab.exe
Resource
win7-20240221-en
General
-
Target
321301950c449ed3bd6f1e08a93e401bc5bfc74cb63036dbce111b5f0cd5d6ab
-
Size
1.7MB
-
MD5
be5ebb77526f9febc0d6f0863a01ab75
-
SHA1
3596ddbbba0bb079bd8a7baee46a25938e26b513
-
SHA256
321301950c449ed3bd6f1e08a93e401bc5bfc74cb63036dbce111b5f0cd5d6ab
-
SHA512
9982bb205466287ded4fbb025ed831d1c733c8fa7479d76fadd8ffcf483efdd25e3fed585c4c730766069ca4545b5f704840e7e06b06a28d5f380ab2eb690b20
-
SSDEEP
49152:UF2vrLK+OLkjKJ4kzEBLl4wBH8s0fTsHrQkP:UF2vrLnGJ4tVlLcsZrQkP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 321301950c449ed3bd6f1e08a93e401bc5bfc74cb63036dbce111b5f0cd5d6ab
Files
-
321301950c449ed3bd6f1e08a93e401bc5bfc74cb63036dbce111b5f0cd5d6ab.exe windows:4 windows x86 arch:x86
1660bf4a3927a1c5c5c5510f6ecc6071
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFullPathNameA
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__doserrno
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_close
_errno
_exit
_fdopen
_filelengthi64
_fileno
_fileno
_findclose
_findfirst
_findnext
_fstati64
_fullpath
_get_osfhandle
_getcwd
_chmod
_initterm
_iob
_onexit
_open
_stati64
_strdup
_stricmp
_strnicmp
_umask
_unlink
_vsnprintf
_wcsnicmp
abort
atoi
bsearch
ctime
calloc
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
ftell
fread
free
fseek
fsetpos
fwrite
getc
getenv
islower
isspace
isupper
localtime
malloc
mbstowcs
memset
memchr
memcmp
memcpy
memmove
printf
putc
putchar
puts
qsort
realloc
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
time
ungetc
vfprintf
vprintf
user32
CharLowerBuffA
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 614KB - Virtual size: 614KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 55KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE