Static task
static1
Behavioral task
behavioral1
Sample
42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc.exe
Resource
win10v2004-20240226-en
General
-
Target
42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc.exe
-
Size
206KB
-
MD5
21be39a453a79ef484ce58b901ba8386
-
SHA1
2c38dc7aa29fa9e06902d964022495e1af9ab175
-
SHA256
42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc
-
SHA512
bd58cb596f6df702a955c3f8df5cff59417ae30560c3faed53edd010ec3ea6b464b795eca8e035a7b5ea94a2bd0158e5f8e555c666e515ed1315ac71022858f0
-
SSDEEP
3072:ZuMSJVSEN/NDrNRJ/g8a90dcXyl/74OBnd+pWt0vkOTnYqTVMIgbPrRfSZbGV:ZuMcSElNnjJ3TcXyh74OTa40Mkn7VFI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc.exe
Files
-
42732ad450696b816913753fa9f53b52ac10922a1df1b5795693db77d532ffbc.exe.exe windows:5 windows x86 arch:x86
07405d21a8f91424e12553de11f67aa2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetVolumeLabelA
SetPriorityClass
SetThreadContext
TlsGetValue
SetLocalTime
GetNumberOfConsoleInputEvents
GetUserDefaultLCID
_lcreat
SetTapeParameters
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
ReadConsoleW
SetProcessPriorityBoost
GlobalAlloc
GetPrivateProfileIntA
LoadLibraryW
GetConsoleMode
Sleep
WritePrivateProfileStructW
GetBinaryTypeA
EnumResourceNamesW
ReadFile
lstrcatA
lstrlenW
SetThreadPriority
DeactivateActCtx
GetNamedPipeHandleStateW
GetProcAddress
GetTapeStatus
ReadFileEx
GetConsoleDisplayMode
SearchPathA
CreateSemaphoreW
LocalAlloc
SetConsoleDisplayMode
SetCurrentDirectoryW
AddAtomA
GetPrivateProfileStructA
CloseHandle
DebugBreak
lstrcpyW
TerminateProcess
FileTimeToDosDateTime
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapAlloc
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
GetCPInfo
RtlUnwind
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentProcessId
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
CreateFileA
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
HeapSize
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
SetFilePointer
SetEndOfFile
GetProcessHeap
LoadLibraryA
GetModuleHandleA
GetLocaleInfoW
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
gdi32
GetCharWidthA
Sections
.text Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 43.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ