Static task
static1
Behavioral task
behavioral1
Sample
0892b74b21df4ea012169163a406f138481b4832e287af01dee7afaca5d2d412.exe
Resource
win7-20231129-en
General
-
Target
0892b74b21df4ea012169163a406f138481b4832e287af01dee7afaca5d2d412
-
Size
947KB
-
MD5
88026623039719c2a9a5ece93d40ba12
-
SHA1
ace8e282e93e6947b97d30f6ac6a545637fa8ea2
-
SHA256
0892b74b21df4ea012169163a406f138481b4832e287af01dee7afaca5d2d412
-
SHA512
9e6a42ca7ab5f0e331b5b5c453ddae72ae269845f3ecca1ac157d81c89ff3a625bcbbd7c200bd941660356aed43a88e098d993e71a7342149bcbb410ff8999ce
-
SSDEEP
24576:HKZwzopg8ECGdAb5fi8H+3ZbgnvM5X9HCuAKrb7A0eB5BLG:IQoD9GKdQ3Z5883Zv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0892b74b21df4ea012169163a406f138481b4832e287af01dee7afaca5d2d412
Files
-
0892b74b21df4ea012169163a406f138481b4832e287af01dee7afaca5d2d412.exe windows:4 windows x86 arch:x86
60f9f6c9f0c5963bfe0c0c665ebef895
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetConsoleCursorInfo
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentThread
GetFileAttributesA
GetFileSize
GetModuleFileNameA
GetNumberOfConsoleMouseButtons
GetPriorityClass
GetStdHandle
GetTickCount
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
MapViewOfFile
OutputDebugStringA
PeekConsoleInputA
ReadConsoleInputA
ReadConsoleOutputA
SetConsoleActiveScreenBuffer
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTitleA
SetConsoleWindowInfo
SetPriorityClass
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
UnmapViewOfFile
WaitForSingleObject
WriteConsoleOutputA
WriteConsoleOutputCharacterA
msvcrt
_close
_fdopen
_fileno
_getch
_getpid
_isatty
_kbhit
_lseek
_open
_pclose
_popen
_stat
_strdup
_unlink
_write
_HUGE
__getmainargs
__p__environ
__set_app_type
_cexit
_errno
_fileno
_findclose
_findfirst
_findnext
_fmode
_fpreset
_iob
_setmode
_stricmp
_strnicmp
_wcsicmp
abort
atan
atexit
atof
atoi
bsearch
calloc
ceil
cos
exit
exp
fclose
ferror
fflush
fgetc
fgets
floor
fopen
fprintf
fputs
fread
free
frexp
fseek
ftell
fwrite
getenv
isalnum
isalpha
isdigit
islower
isspace
isupper
ldexp
log
log10
malloc
memchr
memcpy
memmove
memset
pow
printf
putc
putchar
puts
qsort
rand
realloc
rewind
scanf
signal
sin
sprintf
sqrt
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtod
strtok
strtol
time
tolower
toupper
vfprintf
vsprintf
user32
MapVirtualKeyA
MessageBeep
wsprintfA
winmm
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetNumDevs
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
timeBeginPeriod
timeEndPeriod
timeKillEvent
timeSetEvent
waveOutClose
waveOutGetDevCapsA
waveOutGetID
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
wsock32
WSAStartup
closesocket
connect
gethostbyname
htons
inet_addr
recv
select
send
shutdown
socket
Sections
.text Size: 781KB - Virtual size: 780KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE