Static task
static1
Behavioral task
behavioral1
Sample
c1f707b7e1f3463398e77e15253836a0f230136b0a2f21fb3a3081fa4c46b3af.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c1f707b7e1f3463398e77e15253836a0f230136b0a2f21fb3a3081fa4c46b3af.exe
Resource
win10v2004-20240426-en
General
-
Target
c1f707b7e1f3463398e77e15253836a0f230136b0a2f21fb3a3081fa4c46b3af
-
Size
2.3MB
-
MD5
7685cfe0e0e97c1059a6ff9af7a1e99d
-
SHA1
9b61af613ab42ffe54c15420810356cddb47cbdb
-
SHA256
c1f707b7e1f3463398e77e15253836a0f230136b0a2f21fb3a3081fa4c46b3af
-
SHA512
5a44defb7ee0e0861127240b0de3deb4a7c5a22079f6c44af1060bc1dbf3913128f9da0b31e64a61af5e7eda1b73c0898c892effae47533a312edc335e34a9d3
-
SSDEEP
49152:MVGvP+l6If+3EZsYPk+oFNLJi7cKTKzmZN3vAmKIpKI:MQvPmV6YUFNI7xezkN3oIkI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1f707b7e1f3463398e77e15253836a0f230136b0a2f21fb3a3081fa4c46b3af
Files
-
c1f707b7e1f3463398e77e15253836a0f230136b0a2f21fb3a3081fa4c46b3af.exe windows:5 windows x86 arch:x86
1f5f2eda85a7f0f0cb96a58b1c50c1c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
gdiplus
GdipFree
iocptcp
TcpSend
iocpudp
UdpInit
user32
GetDC
gdi32
SaveDC
comdlg32
GetFileTitleA
advapi32
FreeSid
shell32
DragFinish
ole32
CoInitialize
oleaut32
SysAllocString
disklessmultiserver
InitMultiSvr
ws2_32
inet_addr
iphlpapi
SendARP
version
VerQueryValueA
crypt32
CryptMsgClose
wintrust
WinVerifyTrust
rpcrt4
UuidCreate
imm32
ImmGetContext
comctl32
ord17
dbghelp
MiniDumpWriteDump
shlwapi
PathIsUNCA
wininet
InternetOpenA
psapi
GetProcessMemoryInfo
winhttp
WinHttpOpen
Sections
.MPRESS1 Size: 2.0MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 344KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE