ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
e4907f0a83ea2dbf0f8033eb98aee1b588c9c65036cf0230ef351a53867d0127.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e4907f0a83ea2dbf0f8033eb98aee1b588c9c65036cf0230ef351a53867d0127.exe
Resource
win10v2004-20240226-en
General
-
Target
e4907f0a83ea2dbf0f8033eb98aee1b588c9c65036cf0230ef351a53867d0127
-
Size
102KB
-
MD5
30d6590df660b428b5fd5e2d0708f193
-
SHA1
26b8faaf301c2b6bc180f179d0d68f3f0fd419ab
-
SHA256
e4907f0a83ea2dbf0f8033eb98aee1b588c9c65036cf0230ef351a53867d0127
-
SHA512
02052dfc9e920848aa48cde380a64c39b5a2969b982b0564dedd2af9b3445895fdbed0f72f2fb4d2c4e2b92c69f5668f8564179b810442795a499fe59fcd0175
-
SSDEEP
1536:SZ+qFHmfuCHTz8iSvrKvSXVb2I6+tk7Xt/3lklQce:KlmfHLQq+tk75VklQN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e4907f0a83ea2dbf0f8033eb98aee1b588c9c65036cf0230ef351a53867d0127
Files
-
e4907f0a83ea2dbf0f8033eb98aee1b588c9c65036cf0230ef351a53867d0127.exe windows:4 windows x86 arch:x86
cfdf1e9c1f414aaca65a55a157d1128d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
Process32First
CreateToolhelp32Snapshot
WaitForSingleObject
CreateEventA
ExitProcess
SetEvent
InterlockedExchange
Process32Next
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
HeapAlloc
GetProcessHeap
HeapFree
LocalFree
GetCurrentProcess
GetLastError
ExpandEnvironmentStringsA
CreatePipe
GetStartupInfoA
CreateProcessA
CloseHandle
PeekNamedPipe
Sleep
ReadFile
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
CreateFileA
RtlUnwind
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetModuleHandleA
GetCommandLineA
GetVersion
TerminateProcess
HeapReAlloc
HeapSize
TlsAlloc
SetLastError
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
SetFilePointer
InitializeCriticalSection
WriteFile
UnhandledExceptionFilter
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
RaiseException
user32
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
gdi32
GetStockObject
advapi32
SetServiceStatus
GetTokenInformation
EqualSid
ConvertSidToStringSidA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterServiceCtrlHandlerW
wininet
InternetSetOptionA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetCrackUrlA
InternetSetCookieA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE