Static task
static1
Behavioral task
behavioral1
Sample
xjEbd9k.exe
Resource
win7-20231129-en
General
-
Target
xjEbd9k
-
Size
130KB
-
MD5
7ebc135f08863359b9089a86149b9737
-
SHA1
84c87bc0c3354aad42fae4e5b2d2c2fd7c129688
-
SHA256
aaf3217873dc472a323ea35b46a945635a4b20fc9ccec6eae30cef0ab770e16f
-
SHA512
ea893856ac6aee3c5225c5fe67d1a9c0e3d4f366289802ba670381973d84831dd208a2bb0e1f54a058d2840b13c9b3c306c63bbfb75cb83665de455a292ab34b
-
SSDEEP
1536:Z3Hh76d0SmQgo6OW8EneylqAjBzslMlGAuZWLEORE0A63Q6/ASDfBUisoY9bDy5y:FhMgTTeW4lMyWLxR3A6h/Px00Dy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource xjEbd9k
Files
-
xjEbd9k.exe windows:5 windows x86 arch:x86
0783cb37ef1240ef0478a960a2f29610
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptSignHashA
InitializeAcl
RegReplaceKeyW
RegSaveKeyA
IsValidSid
RegCreateKeyExA
RegLoadKeyA
IsValidAcl
RegEnumKeyA
OpenEventLogW
ReadEventLogA
RegRestoreKeyA
RegUnLoadKeyA
kernel32
GetProcAddress
OpenWaitableTimerA
GetWindowsDirectoryW
CreateFileW
GetCurrencyFormatW
FindResourceExA
IsBadStringPtrW
InterlockedExchange
FindFirstFileW
GetFullPathNameA
GetProfileStringA
GlobalAddAtomA
LoadLibraryExW
SetEvent
GetModuleHandleA
CreateMutexW
GetPriorityClass
ReadFile
lstrcpy
GetConsoleTitleA
CreateFileMappingW
ResumeThread
OpenMutexA
FormatMessageA
CreateSemaphoreA
GetLogicalDriveStringsA
WaitForSingleObject
InterlockedIncrement
GetConsoleAliasW
GetStartupInfoA
ReadConsoleW
GetPrivateProfileIntA
FindNextFileA
modemui
CountryRunOnce
drvGetDefaultCommConfigA
InvokeControlPanel
user32
IsDialogMessageW
CreateDesktopW
LoadMenuW
PostMessageW
DrawStateA
CharToOemA
IsCharLowerW
LoadCursorA
GetClassLongA
FlashWindow
DialogBoxParamA
LoadBitmapA
PeekMessageA
GetPropA
wsprintfA
authz
AuthzAddSidsToContext
AuthzInitializeContextFromSid
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 812KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ