Static task
static1
Behavioral task
behavioral1
Sample
8e1de10aa317fb80bb1f287ac6b713d410b1548862b99cb67941acd7f3e0cdf2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8e1de10aa317fb80bb1f287ac6b713d410b1548862b99cb67941acd7f3e0cdf2.exe
Resource
win10v2004-20240226-en
General
-
Target
8e1de10aa317fb80bb1f287ac6b713d410b1548862b99cb67941acd7f3e0cdf2
-
Size
88KB
-
MD5
18b1f15346c77e40368f78e376149396
-
SHA1
a43ebe4e931eaf5c801635d9091f2fb78c8bd26d
-
SHA256
8e1de10aa317fb80bb1f287ac6b713d410b1548862b99cb67941acd7f3e0cdf2
-
SHA512
491e6ab0c6308a82b6b5be926e7f70eb904552b4e7867047f467cf5eac179fffcac9f50b0f731cfe5abd0c98faeaed95570c020389ec574d1bafe7dbaf8ac3cf
-
SSDEEP
1536:Y+gH6lp44mAb4wYnBM4cLKnxkisg6absyRC7:nSW/a/116abbRC7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e1de10aa317fb80bb1f287ac6b713d410b1548862b99cb67941acd7f3e0cdf2
Files
-
8e1de10aa317fb80bb1f287ac6b713d410b1548862b99cb67941acd7f3e0cdf2.exe windows:5 windows x86 arch:x86
a011fe835f125f6f675a38413c379b66
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
CreateToolhelp32Snapshot
WriteFile
ExpandEnvironmentStringsA
Sleep
SetFilePointer
WaitForSingleObject
DeleteFileA
GetTickCount
GetModuleFileNameA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
OpenProcess
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
Process32Next
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
GetCurrentProcess
GetLastError
CreateFileA
GetFileSize
CloseHandle
ReadFile
LoadLibraryA
HeapSize
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetProcAddress
RtlUnwind
ExitThread
GetCurrentThreadId
CreateThread
RaiseException
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
user32
DestroyWindow
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
LoadStringA
SendMessageTimeoutA
RegisterClassExA
SetClipboardViewer
SendMessageA
ChangeClipboardChain
LoadCursorA
PostQuitMessage
DefWindowProcA
CreateWindowExA
ShowWindow
UpdateWindow
advapi32
RegOpenKeyExA
RegOpenKeyA
GetTokenInformation
EqualSid
ConvertSidToStringSidA
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
ole32
CoCreateGuid
wininet
InternetCloseHandle
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetConnectA
shlwapi
SHRegGetValueA
iphlpapi
GetAdaptersInfo
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ