CeyEvent@12
Static task
static1
Behavioral task
behavioral1
Sample
020bac812430b5d4f4a0cf72a9030a05c89dd2dec0b59ea73b3dfae47c4ee200.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
020bac812430b5d4f4a0cf72a9030a05c89dd2dec0b59ea73b3dfae47c4ee200.exe
Resource
win10v2004-20240226-en
General
-
Target
020bac812430b5d4f4a0cf72a9030a05c89dd2dec0b59ea73b3dfae47c4ee200
-
Size
260KB
-
MD5
0312b8f6e1535dda4780c6f7bfacc968
-
SHA1
287007dee1e5c467f06478e027b144e77bb8a1cc
-
SHA256
020bac812430b5d4f4a0cf72a9030a05c89dd2dec0b59ea73b3dfae47c4ee200
-
SHA512
0926b3fb33d5c634cdf121abf2edb3d49eb1faba40e852efdcbf6e5a8eddad436272f3e5e7da1ea3ae8ead6b097eb38246e385c020d2e2353ac6873ff7b2afc0
-
SSDEEP
6144:aJhBhrAXvQE9hPD7l08BkjIf0r9bfif7/F0ZiCsRUXnd+E6buPR:avAPPD3Bk0Mr9jif7/F1hRUN+hbmR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 020bac812430b5d4f4a0cf72a9030a05c89dd2dec0b59ea73b3dfae47c4ee200
Files
-
020bac812430b5d4f4a0cf72a9030a05c89dd2dec0b59ea73b3dfae47c4ee200.exe windows:4 windows x86 arch:x86
ea28f662ab831803e9a8c823439760d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msvcrt
_getcwd
_mkdir
_sleep
_stat
_strlwr
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_findclose
_findfirst
_findnext
_fullpath
_iob
_onexit
_setmode
abort
atexit
difftime
exit
fclose
fflush
fopen
fprintf
fputc
fread
free
fseek
fwrite
getenv
localtime
malloc
printf
rand
signal
srand
time
advapi32
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
kernel32
AddAtomA
CloseHandle
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
ExitProcess
FindAtomA
GetAtomNameA
GetDriveTypeA
GetFileAttributesA
GetLastError
GetLogicalDriveStringsA
GetModuleHandleA
GetProcAddress
LoadLibraryA
Module32First
Process32First
Process32Next
SetFileAttributesA
SetUnhandledExceptionFilter
ntdll
atoi
atol
memcpy
memset
sprintf
strcat
strcpy
strlen
tolower
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
user32
CallNextHookEx
DispatchMessageA
GetKeyNameTextA
GetMessageA
MessageBoxA
SetWindowsHookExA
TranslateMessage
UnhookWindowsHookEx
ws2_32
WSACleanup
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
getaddrinfo
gethostbyname
gethostname
htons
listen
recv
select
send
socket
Exports
Exports
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ