Static task
static1
Behavioral task
behavioral1
Sample
8ed03b1d544444b42385e79cd17c796fefae71d140b146d0757a3960d8ba3cba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8ed03b1d544444b42385e79cd17c796fefae71d140b146d0757a3960d8ba3cba.exe
Resource
win10v2004-20240226-en
General
-
Target
8ed03b1d544444b42385e79cd17c796fefae71d140b146d0757a3960d8ba3cba
-
Size
10.0MB
-
MD5
fc40434947caee8b0b3237ca03208716
-
SHA1
d33489c5d379e0c869c3dbf169e0005d70e4fb31
-
SHA256
8ed03b1d544444b42385e79cd17c796fefae71d140b146d0757a3960d8ba3cba
-
SHA512
a8cc4a51f33baa5642e4a7a287f4950ae31f6985855827af19e9a8f64abe571af414c579258ca753c2fb0fda918656dd4362b01d635108b239a0764636b42c28
-
SSDEEP
196608:eJisXSymsl+tbeER1XQKM9g+N2Pa2dyptWx/tXyIeT:oiO/msl+tbp1X4r2PavW51veT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8ed03b1d544444b42385e79cd17c796fefae71d140b146d0757a3960d8ba3cba
Files
-
8ed03b1d544444b42385e79cd17c796fefae71d140b146d0757a3960d8ba3cba.exe windows:6 windows x86 arch:x86
4cf470fab15d30af058620f22bafa840
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
GetUserNameA
GetCurrentHwProfileA
RegCloseKey
RegCreateKeyExW
RegSetValueExW
user32
TranslateMessage
DispatchMessageA
DefWindowProcW
RegisterClassA
GetMessageA
CreateWindowExA
DestroyWindow
UnregisterClassA
ws2_32
gethostbyname
WSACleanup
WSAStartup
crypt32
CryptBinaryToStringA
wininet
InternetGetConnectedState
HttpSendRequestA
InternetReadFile
shell32
ShellExecuteA
SHCreateDirectoryExW
SHCreateDirectoryExA
kernel32
HeapReAlloc
HeapSize
ReadConsoleW
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
WriteConsoleW
SetEndOfFile
GetACP
IsValidCodePage
FindFirstFileExW
CloseHandle
WaitForMultipleObjects
CreateThread
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
CreateFileA
GetFileSize
ReadFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetLogicalDrives
GetVolumeInformationA
Sleep
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetComputerNameA
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetWindowsDirectoryW
GetModuleHandleA
DeleteFileW
CreateFileW
WriteFile
TerminateProcess
OpenProcess
QueryFullProcessImageNameW
GetVolumeInformationW
CopyFileW
GetFileTime
CreateProcessA
GetModuleFileNameA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
LCMapStringW
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MoveFileExW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
CompareStringW
DecodePointer
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ