Static task
static1
Behavioral task
behavioral1
Sample
5D474E6A5232B3D3DD5576111A2B22A1.exe
Resource
win7-20240508-en
General
-
Target
5D474E6A5232B3D3DD5576111A2B22A1.exe
-
Size
8.4MB
-
MD5
5d474e6a5232b3d3dd5576111a2b22a1
-
SHA1
60923eeaaf6334dde034a338302bcc25a2552618
-
SHA256
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc
-
SHA512
93794f9a4548c55ab64bdf0a72a5aa08271e7ca58793de0c20c34dbff679638c22a6515e8c402ed8cf41c0a8db25f2aea33a2552fb633f43fc1bcfd7d22fdfae
-
SSDEEP
98304:tVDbpZYm4jCCC08mudOK+rdYsL9mJ+C01l96Y:tVDbpZYxBC0wWrdYB+tl9B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 5D474E6A5232B3D3DD5576111A2B22A1.exe
Files
-
5D474E6A5232B3D3DD5576111A2B22A1.exe.exe windows:1 windows x86 arch:x86
140094f13383e9ae168c4b35b6af3356
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
ExitProcess
GetComputerNameA
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
SetErrorMode
Sleep
VirtualAllocExNuma
shlwapi
PathFindFileNameA
msvcrt
malloc
free
memset
strcmp
_strcmpi
strcpy
Sections
.text Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ