Static task
static1
Behavioral task
behavioral1
Sample
08e7690881e2fc5ccaf6a8f085c4bbe7f5f4cc54081b68a108b6636bf8c877b2.exe
Resource
win7-20240221-en
General
-
Target
08e7690881e2fc5ccaf6a8f085c4bbe7f5f4cc54081b68a108b6636bf8c877b2
-
Size
764KB
-
MD5
7515efc0c982b5f94c4b089053422a60
-
SHA1
39be3a53a898499e3df027e1906c528ee951b2da
-
SHA256
08e7690881e2fc5ccaf6a8f085c4bbe7f5f4cc54081b68a108b6636bf8c877b2
-
SHA512
1879c55aac5f1ba7fbfd093bd98fe0098d2e06c7cd03354d280c851c2f281f0504febfaecae7e4cd11bb1ac9d3175bed35502759781cf2b8e2f8e7e547e123d8
-
SSDEEP
12288:fecC3WFhSxt48NGnkLkIOV2GRxZPRkBggggMpYPu6Cuoildo6RxOarEno8nbhhYx:fs3OhSxhGh2kxBRkBggggMKPtKYOo8ne
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08e7690881e2fc5ccaf6a8f085c4bbe7f5f4cc54081b68a108b6636bf8c877b2
Files
-
08e7690881e2fc5ccaf6a8f085c4bbe7f5f4cc54081b68a108b6636bf8c877b2.exe windows:5 windows x86 arch:x86
6563644d84e54a7213a22c612c62eead
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
LocalAlloc
LocalFree
OpenProcess
TerminateProcess
GetLogicalDriveStringsW
GetVersionExW
CreateDirectoryW
LockResource
LoadResource
SizeofResource
GetFileSize
WriteFile
ReadFile
FindResourceW
FindResourceExW
CreateFileA
DeleteFileW
GetModuleHandleW
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
SetLastError
LoadLibraryA
IsBadReadPtr
GlobalFree
DeviceIoControl
GetSystemDirectoryA
IsDebuggerPresent
OutputDebugStringW
Sleep
FlushFileBuffers
GetTickCount
FindNextFileW
GetNativeSystemInfo
FindClose
CreateFileW
CloseHandle
SetErrorMode
GetCurrentThreadId
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentProcess
DeleteCriticalSection
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
FreeLibrary
GetProcAddress
GetModuleFileNameW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
WriteConsoleW
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetFileType
GetTimeZoneInformation
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
LoadLibraryW
TryEnterCriticalSection
GetStringTypeW
QueryPerformanceCounter
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
advapi32
LookupAccountSidW
RegOpenKeyExW
RegSetValueExW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
GetUserNameW
ole32
CoInitialize
CoUninitialize
shell32
SHGetFolderPathW
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW
dbghelp
MiniDumpWriteDump
psapi
GetProcessImageFileNameW
EnumProcesses
urlmon
ObtainUserAgentString
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
Sections
.text Size: 379KB - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 82KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE