Static task
static1
Behavioral task
behavioral1
Sample
82fefcdff92a126c9da017c3c0ee5ac8b91bb80cdbd60b44be9bf1fa127bf32c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
82fefcdff92a126c9da017c3c0ee5ac8b91bb80cdbd60b44be9bf1fa127bf32c.exe
Resource
win10v2004-20240426-en
General
-
Target
82fefcdff92a126c9da017c3c0ee5ac8b91bb80cdbd60b44be9bf1fa127bf32c
-
Size
380KB
-
MD5
78d41f7ab162101f5487ecf43e94afcd
-
SHA1
5c36396be35d63dff65f5982cb7db38746651546
-
SHA256
82fefcdff92a126c9da017c3c0ee5ac8b91bb80cdbd60b44be9bf1fa127bf32c
-
SHA512
69785b84e11e0927dd0dabfffd635a28933150e3a7e7cce7001aa236b8e4b09b5a6af6c4eeb5de951a60eecdf7c9cd715c5f6bb47793e0cfc45c739ec34855aa
-
SSDEEP
3072:SIbvqGgJIyCv5ZYfcsJNTgcoMkBATG5QUsEue50iiah0pl4PTKpCXn5Ma8RyOrkt:S+vqGgCv5Wbk5o1kTDHB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82fefcdff92a126c9da017c3c0ee5ac8b91bb80cdbd60b44be9bf1fa127bf32c
Files
-
82fefcdff92a126c9da017c3c0ee5ac8b91bb80cdbd60b44be9bf1fa127bf32c.exe windows:4 windows x86 arch:x86
c298f73153681059ca388ab4ac5cd02a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
socket
select
htonl
__WSAFDIsSet
WSAStartup
WSACleanup
setsockopt
listen
accept
closesocket
shutdown
bind
connect
send
recv
ioctlsocket
WSAGetLastError
gethostbyname
inet_ntoa
getsockname
recvfrom
sendto
WSASocketA
inet_addr
mfc42
ord1168
ord1206
ord2623
ord290
ord1223
ord4622
ord4226
ord2486
ord4003
ord446
ord743
ord665
ord354
ord4033
ord800
ord535
ord540
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3262
ord3081
ord3738
ord561
ord815
ord6215
ord2086
ord858
ord537
ord5500
ord6354
ord5716
ord5717
ord2621
ord1134
ord1199
ord1205
ord614
ord4376
ord4853
ord4998
ord4710
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord641
ord4234
ord1816
ord1146
ord434
ord5575
ord1576
ord2763
ord2642
ord3092
ord2379
ord755
ord470
ord839
ord433
ord1200
ord2141
ord3499
ord3177
ord2515
ord355
ord4224
ord5683
ord4277
ord465
ord464
ord1105
ord1656
ord4424
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord2985
ord3136
ord4465
ord3259
ord3147
ord2982
ord1799
ord825
ord823
ord5265
ord4129
msvcrt
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_onexit
__dllonexit
malloc
sprintf
_ftol
_mbscmp
_purecall
_iob
fprintf
_open
_lseek
_close
_read
time
ctime
vsprintf
free
__CxxFrameHandler
_setmbcp
_strdup
kernel32
AllocConsole
GetStartupInfoA
SetFilePointer
CreateFileA
MoveFileExA
CloseHandle
WriteFile
GetStdHandle
OutputDebugStringA
WriteConsoleA
Sleep
lstrcpyA
SetCurrentDirectoryA
GetCurrentDirectoryA
WideCharToMultiByte
GetTickCount
GetCurrentProcessId
GetModuleHandleA
SetEndOfFile
user32
EnableWindow
DrawIcon
GetClientRect
GetSystemMetrics
LoadIconA
IsIconic
GetForegroundWindow
SetCursorPos
EnumDisplaySettingsA
SendMessageA
MessageBoxA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
ole32
StringFromGUID2
oleaut32
VariantClear
Sections
.text Size: 308KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ