Static task
static1
Behavioral task
behavioral1
Sample
867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36.exe
Resource
win10v2004-20240226-en
General
-
Target
867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36
-
Size
2.1MB
-
MD5
5d43baf1c9e9e3a939e5defd8f8fbd8d
-
SHA1
d5ff73c043f3bb75dd749636307500b60a436550
-
SHA256
867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36
-
SHA512
d2126c4ea1088f3f614e2a2c1b5c629f34c57bcb6fff324ded9c13e6e5f1da284bd57efeb736c1af38464ea294800de867c34b22f39d9007a8788e07509723de
-
SSDEEP
24576:y3SY+/2M3BMr7cdgSLBjbr4nzzy95VV7cEXV:ESZ2ESrHSV3D95oA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36
Files
-
867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36.exe windows:6 windows x64 arch:x64
c5a1c18637aa8a3e490652fc13e941e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
lstrlenW
MultiByteToWideChar
Sleep
GetLastError
WideCharToMultiByte
ReadFile
GetLogicalDrives
FindFirstFileW
FindNextFileW
WriteFile
TerminateProcess
GetDriveTypeA
SetFileTime
SetErrorMode
SetFilePointer
GetTempPathW
lstrlenA
FindClose
WaitForSingleObject
CreateFileW
lstrcatW
GetVersionExA
DeleteFileW
CloseHandle
SystemTimeToFileTime
CreateProcessW
lstrcpyW
GetSystemTime
lstrcmpW
GetFileTime
CreateThread
CompareFileTime
CreateMutexA
GetTickCount
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetFileType
GetStringTypeW
RaiseException
ole32
CoCreateGuid
ws2_32
gethostname
gethostbyname
WSACleanup
WSAStartup
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpWriteData
urlmon
ObtainUserAgentString
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
Sections
.text Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 414KB - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE