Static task
static1
Behavioral task
behavioral1
Sample
96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef.exe
Resource
win10v2004-20240226-en
General
-
Target
96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef
-
Size
830KB
-
MD5
9084ba9e0f2dc1a346638b8b000512fe
-
SHA1
75ee3a41f7fe4fb8da5f5d7df4a8050609ce0f8a
-
SHA256
96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef
-
SHA512
8520e6eb10a7459ff1fde9baa0e5dcafa3f4839bac3ad1f9865ec562eaa0f853394030ffb097c46a6113a9d593dc7dffa9483651bdbfb711d54b5935bdbf7eee
-
SSDEEP
12288:WNVVNWURpbVuS3SdgpRRuuWkEbQbltoTAVUZPL5iO:WNVH3X6YRVsbQ5taA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef
Files
-
96ae4d7d4475864ad3727493814e08346f46b13a665655ff631be0fceda29aef.exe windows:6 windows x64 arch:x64
aba23b4e2b7165237ce14f4ab171b5ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetModuleFileNameA
SizeofResource
GetCurrentProcess
DeviceIoControl
VirtualAlloc
DeleteFiber
CreateMutexA
CreateFileW
SwitchToFiber
CreateToolhelp32Snapshot
GetLastError
Process32NextW
SetFileInformationByHandle
QueryFullProcessImageNameA
CreateFileA
LockResource
DeleteFileA
Process32FirstW
CloseHandle
GetSystemInfo
LoadResource
FindResourceW
GetFileSize
GlobalMemoryStatusEx
ConvertThreadToFiber
CreateFiber
GetComputerNameA
MultiByteToWideChar
GetModuleHandleExW
FreeLibrary
ExitProcess
Sleep
GetProcAddress
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
shlwapi
PathRemoveFileSpecA
msvcrt
__wgetmainargs
_wcmdln
?_set_new_mode@@YAHH@Z
_commode
_msize
?terminate@@YAXXZ
___lc_codepage_func
ceil
log10
realloc
_clearfp
__set_app_type
strtol
strnlen
wcsnlen
tolower
__pctype_func
strcpy_s
_errno
malloc
_callnewh
_set_fmode
_initterm_e
_initterm
free
calloc
memmove
_amsg_exit
_CxxThrowException
memset
strrchr
__C_specific_handler
wctomb_s
_XcptFilter
memcpy
__CxxFrameHandler3
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 778KB - Virtual size: 778KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ