Static task
static1
Behavioral task
behavioral1
Sample
55d8c63b40bd4663eb5644f2a45f6e5ddf1587f4225973b93d3b18cdef6b0d41.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
55d8c63b40bd4663eb5644f2a45f6e5ddf1587f4225973b93d3b18cdef6b0d41.exe
Resource
win10v2004-20240412-en
General
-
Target
55d8c63b40bd4663eb5644f2a45f6e5ddf1587f4225973b93d3b18cdef6b0d41
-
Size
320KB
-
MD5
b5f3363995f62a6a2cec1e3b7bdbf963
-
SHA1
82910e07fc6212b1ebf361e1059df6f886d937ac
-
SHA256
55d8c63b40bd4663eb5644f2a45f6e5ddf1587f4225973b93d3b18cdef6b0d41
-
SHA512
e0c67298ceb065893c67042a90d5c3cbb398eda2904a058829e8921d4fcd353e06dc1f585d7f1bc6df1e388fee82f5f154edb3d11075feb28939f6ecdcb46753
-
SSDEEP
6144:h21eLLAquoL4KpxxbxDxxxx155nZxs1UiKuu:0YLLAtoL4KxxbxDxxxx15VZxr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55d8c63b40bd4663eb5644f2a45f6e5ddf1587f4225973b93d3b18cdef6b0d41
Files
-
55d8c63b40bd4663eb5644f2a45f6e5ddf1587f4225973b93d3b18cdef6b0d41.exe windows:5 windows x86 arch:x86
0139c0d9c82f62b6166cdbfe382bbe5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileAttributesW
GetLastError
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcess
GetVersionExW
MultiByteToWideChar
QueryPerformanceCounter
SetCurrentDirectoryA
SetCurrentDirectoryW
SetFileAttributesA
SetFileAttributesW
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
WideCharToMultiByte
lstrlenW
GetCurrentDirectoryW
GetCurrentDirectoryA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
VirtualAlloc
lstrcatA
GetSystemDirectoryA
CreateFileA
GetVersionExA
ReadFile
user32
RegisterClassExA
LoadStringA
LoadStringW
RegisterWindowMessageA
SendMessageA
LoadIconA
LoadIconW
advapi32
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegOpenKeyA
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegCreateKeyExW
shell32
SHChangeNotify
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ole32
CoInitialize
CoUninitialize
CoCreateInstance
shlwapi
PathRemoveBlanksW
msvcrt
_c_exit
wcsstr
wcslen
mbstowcs
_XcptFilter
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_cexit
_controlfp
_except_handler3
_exit
_initterm
_wcsicmp
exit
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata6 Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata2 Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.htext Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE