Static task
static1
Behavioral task
behavioral1
Sample
0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e.exe
Resource
win10-20240404-en
General
-
Target
0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
-
Size
849KB
-
MD5
403dee0dd3891459b22a8a37828b66b8
-
SHA1
919c33adb648ce13ee8bd7c11bffbfd836936c00
-
SHA256
0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
-
SHA512
8cab8ca9ff17c404d6e41358804daf0915713ad3e8e690457e2f9aab4014c894fd73e406aad8837ed8409be32315a4a0f3ef41795828d7447fde68c6fe9226f2
-
SSDEEP
24576:TdxKSvB4i4sSnMIsBadfBZz4kIsPP3q7uL+gB+UtcMT:Jvei4sSEad5Zz4kIsPP34uL+gB++cW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e
Files
-
0a8297b274aeab986d6336b395b39b3af1bb00464cf5735d1ecdb506fef9098e.exe windows:6 windows x86 arch:x86
153abb8903ee46d09947dae69f2ce7ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathW
GetLastError
CreateMutexW
OpenMutexW
CreateProcessA
GetTickCount
lstrcmpW
MultiByteToWideChar
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
CreateFileW
FindNextFileW
CloseHandle
GetFileSizeEx
ReadFile
WaitForSingleObject
CreateThread
MoveFileW
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
WriteConsoleW
SetStdHandle
FindFirstFileW
WriteFile
FindClose
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
InterlockedPushEntrySList
VirtualQuery
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetModuleFileNameW
GetStdHandle
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
HeapReAlloc
HeapSize
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
SetEndOfFile
shell32
SHChangeNotify
advapi32
RegCreateKeyExW
RegSetValueExW
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom
Sections
.text Size: 636KB - Virtual size: 635KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ