Static task
static1
Behavioral task
behavioral1
Sample
0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb.exe
Resource
win7-20240221-en
General
-
Target
0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb
-
Size
28KB
-
MD5
adb54611fc170de9e86d31181e567db4
-
SHA1
a0a7a7cff0904b406c4304a3f0e4d1436abf6a5c
-
SHA256
0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb
-
SHA512
0ed78e809d51ef88211f275021cbba1e843cba4a22354d4cd95d5b373e3d064eddafcf1b1239acb7064e311736ba67c1eae9800e2120d0764a7a659bd9b1e0f8
-
SSDEEP
384:j5RIDVmZ6zWTmydlSAw5dTxJjWOav8U9c2yweeeeeeeeWeeeee9MMp8pIP:DYijIAWdr9a0UFTeeeeeeeeWeeeee7P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb
Files
-
0549d4e5d930015a66797a046bb931f3266d3a1da327891913b9b04e44c95eeb.exe windows:5 windows x86 arch:x86
b8b034a37970476c0e8791d5941c31e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr90
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
mbstowcs
atoi
_wfopen
fgets
fclose
strtok
strchr
strcpy
strcat
memset
strstr
srand
rand
sprintf
_decode_pointer
strlen
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetOpenUrlW
InternetOpenW
InternetReadFile
shlwapi
StrStrA
StrCmpNA
PathFileExistsW
ws2_32
recv
select
htons
gethostbyname
inet_addr
connect
socket
closesocket
setsockopt
shutdown
WSAStartup
send
dnsapi
DnsQuery_A
DnsFree
kernel32
GetTickCount
lstrlenA
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
ExitThread
ExitProcess
DeleteFileW
CreateThread
ExpandEnvironmentStringsW
GetModuleFileNameW
GetLastError
CreateMutexA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
Sleep
CloseHandle
WriteFile
CreateFileW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetLocalTime
user32
wsprintfA
wsprintfW
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ