Static task
static1
Behavioral task
behavioral1
Sample
9abaf9547de3c6cbaa7e10fc4aa5d41ef8fe90a51fd8e22b38e7648505aadcd5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9abaf9547de3c6cbaa7e10fc4aa5d41ef8fe90a51fd8e22b38e7648505aadcd5.exe
Resource
win10v2004-20240426-en
General
-
Target
9abaf9547de3c6cbaa7e10fc4aa5d41ef8fe90a51fd8e22b38e7648505aadcd5
-
Size
2.8MB
-
MD5
4473880ccf547531c0c01abf35bcbee8
-
SHA1
075c859341ae114209d8287d55e754bf8e7530d1
-
SHA256
9abaf9547de3c6cbaa7e10fc4aa5d41ef8fe90a51fd8e22b38e7648505aadcd5
-
SHA512
ef428741f25d3c879591d435794edade74df7ba4c1a218dbfa415a1d2454f4e11654db77ef70b8846151f6739bdff903e6d6afdfc1e3bbd6470c08019707691f
-
SSDEEP
49152:ahN2skpzPXDFBjWRJTCAIHuDeeaJ98mjRC9YC2Ns+/X0h54GEewK2t2r4PRSEk1i:aj2bz/5YvpI2eey98CRC4L0ZRb2t2sE0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9abaf9547de3c6cbaa7e10fc4aa5d41ef8fe90a51fd8e22b38e7648505aadcd5
Files
-
9abaf9547de3c6cbaa7e10fc4aa5d41ef8fe90a51fd8e22b38e7648505aadcd5.exe windows:5 windows x86 arch:x86
092eb6daba2f17cbda102fd1a32acd00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
kernel32
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile
msvcrt
strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf
advapi32
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken
user32
ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA
ntdll
NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE