Static task
static1
Behavioral task
behavioral1
Sample
8109902d9d6f819c49452ad04725dd5c2fd80c9d9aa4307af9fcbfa3ffff2082.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8109902d9d6f819c49452ad04725dd5c2fd80c9d9aa4307af9fcbfa3ffff2082.exe
Resource
win10v2004-20240226-en
General
-
Target
8109902d9d6f819c49452ad04725dd5c2fd80c9d9aa4307af9fcbfa3ffff2082
-
Size
275KB
-
MD5
6038583b155f73faf1b5ef8135154278
-
SHA1
a04080e8b321b7ca3ee3184b0f48c22d7b78f919
-
SHA256
8109902d9d6f819c49452ad04725dd5c2fd80c9d9aa4307af9fcbfa3ffff2082
-
SHA512
b05947d40df6b56f7222e15ca1e71a17dd7c54ddedcba088324c724fac6b2920ebf51e729265c2edbd6a17a26f28b56509ba64eae537758879818d2148e0ca21
-
SSDEEP
6144:jwWQrGomoWzi3bRKSMQexwSFlD1VrDyp6j5R2narwQF5iGYqyTORfAz:0WXomOISMJw0P3T5R2arwQ7iGIyRfAz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8109902d9d6f819c49452ad04725dd5c2fd80c9d9aa4307af9fcbfa3ffff2082
Files
-
8109902d9d6f819c49452ad04725dd5c2fd80c9d9aa4307af9fcbfa3ffff2082.exe windows:5 windows x86 arch:x86
24d6530be9b03a9ca224bd9899ebbeef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FileTimeToSystemTime
CreatePipe
GetModuleHandleA
CreateProcessA
GetStartupInfoA
GetDriveTypeA
GetSystemDirectoryA
GetDiskFreeSpaceExA
CreateFileA
DeleteFileA
FindFirstFileA
FindNextFileA
CopyFileA
MoveFileA
GetVolumeInformationA
GetComputerNameA
CreateJobObjectA
AssignProcessToJobObject
SetInformationJobObject
GetCurrentThreadId
WaitForSingleObject
GetFileSizeEx
GetNativeSystemInfo
GetVersionExA
FileTimeToLocalFileTime
CreateFileW
DecodePointer
WriteConsoleW
HeapReAlloc
HeapSize
SetFilePointerEx
GetConsoleMode
GetLocalTime
CloseHandle
FindClose
SetFilePointer
ReadFile
WriteFile
SetErrorMode
TerminateProcess
GlobalFree
GlobalAlloc
Sleep
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetProcessHeap
GetFileAttributesExW
GetLastError
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RaiseException
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
HeapAlloc
HeapFree
GetModuleFileNameA
MultiByteToWideChar
GetStdHandle
GetACP
GetFileType
LCMapStringW
GetStringTypeW
advapi32
CryptDecrypt
GetUserNameA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptEncrypt
CryptDestroyKey
CryptDeriveKey
CryptReleaseContext
shell32
SHGetFolderPathA
ws2_32
ntohl
WSAWaitForMultipleEvents
ntohs
closesocket
WSAStartup
recvfrom
sendto
socket
WSACreateEvent
WSAEnumNetworkEvents
htons
WSAEventSelect
inet_addr
shlwapi
PathFileExistsA
iphlpapi
GetNetworkParams
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ