Static task
static1
Behavioral task
behavioral1
Sample
482b160ee2e8d94fa6e4749f77e87da89c9658e7567459bc633d697430e3ad9a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
482b160ee2e8d94fa6e4749f77e87da89c9658e7567459bc633d697430e3ad9a.exe
Resource
win10v2004-20240226-en
General
-
Target
482b160ee2e8d94fa6e4749f77e87da89c9658e7567459bc633d697430e3ad9a
-
Size
145KB
-
MD5
20a04e7fc12259dfd4172f5232ed5ccf
-
SHA1
82f194e6baeef6eefb42f0685c49c1e6143ec850
-
SHA256
482b160ee2e8d94fa6e4749f77e87da89c9658e7567459bc633d697430e3ad9a
-
SHA512
376c03a16845d0b2080a5ec540a81f420b8e0957f9809bf0fd3218a2a4b28724a4a61975ac95314ba769ec9907eb1974c6cfccb0c777d062a314cf4fbbec648b
-
SSDEEP
3072:2jJbNvuT8aktqShKUocWWISUGlPK4NqQvEGEtJYxTZ:w3uctnJUSRqiE0xTZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 482b160ee2e8d94fa6e4749f77e87da89c9658e7567459bc633d697430e3ad9a
Files
-
482b160ee2e8d94fa6e4749f77e87da89c9658e7567459bc633d697430e3ad9a.exe windows:5 windows x86 arch:x86
83de7cbd89e0f17a9c11503452c3da00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
EnumProcesses
GetProcessImageFileNameW
netapi32
NetApiBufferFree
NetShareEnum
iphlpapi
GetIpNetTable
shlwapi
PathAddBackslashW
PathFindFileNameW
kernel32
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileW
FindNextFileW
WriteFile
lstrcpynW
InterlockedDecrement
FindClose
CreateFileW
SetFileAttributesW
Sleep
lstrcatW
CloseHandle
CreateThread
lstrcpyW
lstrcmpW
MoveFileExW
ReadFile
GetFileSizeEx
FindFirstVolumeW
EnterCriticalSection
GetCurrentProcess
TerminateProcess
GetCommandLineA
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
OpenProcess
GetLastError
SetEvent
GetDiskFreeSpaceExW
ResetEvent
GetWindowsDirectoryW
SetFilePointerEx
ExitProcess
CreateProcessW
GetVolumePathNamesForVolumeNameW
CreateEventA
FindNextVolumeW
lstrcmpiW
GetTickCount
DeleteCriticalSection
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
SetStdHandle
GetProcessHeap
FlushFileBuffers
WriteConsoleW
HeapSize
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetFileType
LCMapStringW
GetStringTypeW
HeapReAlloc
user32
wsprintfW
GetKeyboardLayoutList
CharLowerW
advapi32
OpenProcessToken
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
LookupPrivilegeValueA
ControlService
ChangeServiceConfigW
OpenServiceW
QueryServiceStatusEx
Sections
.text Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ