Static task
static1
Behavioral task
behavioral1
Sample
TS-240404-TB2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TS-240404-TB2.exe
Resource
win10v2004-20240226-en
General
-
Target
TS-240404-TB2.exe
-
Size
221KB
-
MD5
16b61a24a6cd3090d1f6210ac9006c7c
-
SHA1
9618960feb88143e056fac81d92719d06b86d8e2
-
SHA256
1bda06eb2ed58ae63e076fd7856133eeb09717e7679c72957de1de7159a575a9
-
SHA512
e43fb244badf332dab1225551a58155bdd85a262bb0041ac282395bf025f48955f6a34aaf3fbcf83b478be82ea5e85a2ce8be41e2f5996a493f2af7bce4c4760
-
SSDEEP
3072:yt5mFQsnQnvgkDwxWzBUEPMZZbude/4v+1IgoWakkgeAHCr1bPpaHI1FeDNAq:q5fsQvgTmBUodLVgoWavsKbP/Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource TS-240404-TB2.exe
Files
-
TS-240404-TB2.exe.exe windows:5 windows x86 arch:x86
cb3e3df0f28477cedc5e120e9c2127ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapDestroy
InterlockedCompareExchange
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
CreateEventA
CloseHandle
Sleep
WaitForSingleObject
SetEvent
FormatMessageW
GetLastError
CreateSemaphoreW
ReleaseSemaphore
GetCurrentThreadId
SwitchToThread
SetLastError
GetNativeSystemInfo
InterlockedExchange
CreateEventW
CancelIo
WideCharToMultiByte
HeapCreate
ResetEvent
CreateWaitableTimerW
SetWaitableTimer
GetProcAddress
LoadLibraryW
TryEnterCriticalSection
ResumeThread
SetThreadContext
GetThreadContext
VirtualAllocEx
GetSystemDirectoryA
GetExitCodeProcess
CreateThread
GetConsoleWindow
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
HeapReAlloc
GetStringTypeW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
VirtualAlloc
lstrlenW
VirtualFree
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
GetProcessHeap
FreeEnvironmentStringsW
FlushFileBuffers
SetFilePointer
ReadFile
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
HeapSize
EncodePointer
DecodePointer
InitializeCriticalSection
RtlUnwind
RaiseException
ExitThread
GetCommandLineW
HeapSetInformation
LCMapStringW
MultiByteToWideChar
GetCPInfo
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetLocaleInfoW
user32
DispatchMessageW
ShowWindow
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
GetInputState
PostThreadMessageA
advapi32
RegCreateKeyW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
ws2_32
WSAEventSelect
send
select
recv
socket
WSACreateEvent
htons
connect
WSAIoctl
setsockopt
closesocket
WSACleanup
WSAStartup
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
shutdown
WSACloseEvent
WSASetLastError
gethostbyname
WSAGetLastError
winmm
timeGetTime
Sections
.text Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ