Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240226-en
General
-
Target
file.exe
-
Size
15KB
-
MD5
2327d962c536672e20be98a0562f7aca
-
SHA1
e4f4239fcdc11a267cb9d707d990c7fe7a592f53
-
SHA256
e4116a48efbd95b8e3b28df1d532a65d6f78116594437dec2434b31cc358f43b
-
SHA512
bdcf9f6b3d31ad91def3cd2f56d55e6877d48de83b0198d050376507a883bab51c7332ff25f68110fc932ffb28d56c4d6ba30b9092ccaadd0e6381bd1d63b30a
-
SSDEEP
384:wvkd9Lh500JKxda6DBZzOppvQ/sbVpu9D2KwI:ykdRE0JKxw67OiEbVp6qI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows:4 windows x86 arch:x86
7bc03fef87208f09e6a996ae9afcec92
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msys-magic-1
magic_check
magic_close
magic_compile
magic_error
magic_file
magic_getpath
magic_load
magic_open
msys-1.0
__errno
__main
abort
calloc
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fgets
fopen
fprintf
free
fwrite
getenv
malloc
memcpy
printf
putc
puts
realloc
rewind
setlocale
strcmp
strcspn
strerror
strlen
strncmp
strrchr
vsnprintf
kernel32
GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data_cy Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 180B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE