ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
602befba2ff4aae4cd6f78cc6925d8ae6ecd3fe9bade4e2315d40fbc9fc067e1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
602befba2ff4aae4cd6f78cc6925d8ae6ecd3fe9bade4e2315d40fbc9fc067e1.exe
Resource
win10v2004-20240226-en
General
-
Target
602befba2ff4aae4cd6f78cc6925d8ae6ecd3fe9bade4e2315d40fbc9fc067e1
-
Size
100KB
-
MD5
dcf67751275d8c706385dbdb8636f9c3
-
SHA1
a85a2b07588701ba6059a638b664905371ac3202
-
SHA256
602befba2ff4aae4cd6f78cc6925d8ae6ecd3fe9bade4e2315d40fbc9fc067e1
-
SHA512
6d2be6a289661e55a6bc0744ddde9d85b7427c20b29777b429fed7d82ad0c80fa3b6b830200ac9d5d1f336e00043120b3e111b6d4eb9eb37444beeb235dcc323
-
SSDEEP
1536:SZ+qFHmfuCHTz8iSvrKvSXVb2I6+tk7Xt/3lklQ:KlmfHLQq+tk75VklQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 602befba2ff4aae4cd6f78cc6925d8ae6ecd3fe9bade4e2315d40fbc9fc067e1
Files
-
602befba2ff4aae4cd6f78cc6925d8ae6ecd3fe9bade4e2315d40fbc9fc067e1.exe windows:4 windows x86 arch:x86
cfdf1e9c1f414aaca65a55a157d1128d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
Process32First
CreateToolhelp32Snapshot
WaitForSingleObject
CreateEventA
ExitProcess
SetEvent
InterlockedExchange
Process32Next
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
HeapAlloc
GetProcessHeap
HeapFree
LocalFree
GetCurrentProcess
GetLastError
ExpandEnvironmentStringsA
CreatePipe
GetStartupInfoA
CreateProcessA
CloseHandle
PeekNamedPipe
Sleep
ReadFile
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
CreateFileA
RtlUnwind
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetModuleHandleA
GetCommandLineA
GetVersion
TerminateProcess
HeapReAlloc
HeapSize
TlsAlloc
SetLastError
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
SetFilePointer
InitializeCriticalSection
WriteFile
UnhandledExceptionFilter
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
RaiseException
user32
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
gdi32
GetStockObject
advapi32
SetServiceStatus
GetTokenInformation
EqualSid
ConvertSidToStringSidA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerW
wininet
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetCrackUrlA
InternetSetCookieA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE