Static task
static1
Behavioral task
behavioral1
Sample
c49e2bd05d47c1ca8436fca7d3c13c3f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c49e2bd05d47c1ca8436fca7d3c13c3f.exe
Resource
win10v2004-20240226-en
General
-
Target
c49e2bd05d47c1ca8436fca7d3c13c3f
-
Size
180KB
-
MD5
c49e2bd05d47c1ca8436fca7d3c13c3f
-
SHA1
da1faa05fd83aefbc208331a183dd45e2ae3fc0c
-
SHA256
7e675a4a0d46e4275637ecd8ebd8078c7bcfd2e300dfabf4b9c46926d23ebe86
-
SHA512
9fdf711e3086afadf316833e9474f9668dd4ac153bc0f9927580f2634f2d0cd5d50cabea52e3aa55db851e0f7cc2858e51b2eb26f66bc075d0676e8b76d10869
-
SSDEEP
3072:bbD2aKYF+M60FP6TO/yOFuE6dCOkz2FgC6uczaZM7PKCGFyXByMrq6ls:bn2aaMJ/lw2iTHZMpGeByCq2s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c49e2bd05d47c1ca8436fca7d3c13c3f
Files
-
c49e2bd05d47c1ca8436fca7d3c13c3f.exe windows:4 windows x86 arch:x86
02fced34849eb2c3d6f45749ff570b52
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileA
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
LoadLibraryA
LocalAlloc
LocalFree
VirtualProtect
lstrcmpiA
FreeLibrary
shell32
SHGetFolderPathA
user32
GetDC
LoadAcceleratorsA
LoadCursorA
LoadIconA
RegisterClassW
ntdll
NtClose
NtOpenKey
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryValueKey
RtlAllocateHeap
RtlFreeHeap
RtlFreeUnicodeString
RtlInitUnicodeString
NtOpenFile
rpcrt4
RpcServerRegisterIf
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
StartServiceCtrlDispatcherA
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 117KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 301B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ydata Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE