Behavioral task
behavioral1
Sample
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6.exe
Resource
win7-20240215-en
Behavioral task
behavioral3
Sample
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6.exe
Resource
win10v2004-20240419-en
General
-
Target
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6
-
Size
30KB
-
MD5
8f1bc2c9a71086445255730d272a3408
-
SHA1
7ab7a0e541850c5729d495097e0d7901771dc8b9
-
SHA256
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6
-
SHA512
3dbfe018e29f014da1f6df132add029ce888d45ed5e22579c060a0a7b32f335433825c2bc41b96ebaafa2830a38bc45caaf656f6d4da67aea7698fc96a1bd6f0
-
SSDEEP
768:4TwkPr8C6fuFdaAna6DCPt34GuYY92rjnPoJlzcamI1:MV8C6fuFdaz6+O1n2rjnPo7
Malware Config
Extracted
systembc
pzlkxadvert475.xyz:4044
pzfdmserv275.xyz:4044
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6
Files
-
c04fb7e860702a4c70586b4b15fb2a12a6821bf0a7e4e95dd8759ca1985c7dd6.exe windows:4 windows x86 arch:x86
17dde48adb7c1f90e4bfb6b6679669b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowTextA
CreateWindowExA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA
GetMessageA
kernel32
WaitForSingleObject
WriteFile
VirtualAlloc
VirtualFree
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
SystemTimeToFileTime
SetFilePointer
Sleep
SetEvent
advapi32
CryptAcquireContextA
CryptExportKey
CryptImportKey
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptDestroyKey
wsock32
htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
WSAStartup
WSACleanup
shell32
CommandLineToArgvW
ShellExecuteA
ws2_32
freeaddrinfo
WSAIoctl
getaddrinfo
ole32
CoUninitialize
CoInitialize
CoCreateInstance
secur32
InitSecurityInterfaceA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
GetUserNameExW
InitializeSecurityContextA
QueryContextAttributesA
crypt32
CryptStringToBinaryA
CryptDecodeObject
psapi
GetModuleFileNameExA
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 676B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ