Static task
static1
Behavioral task
behavioral1
Sample
689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
Resource
win7-20240215-en
General
-
Target
689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
-
Size
2.0MB
-
MD5
6036bd73dbef78a0bb21bace81ca703f
-
SHA1
59cb4799cafe00aba015c8a8eee53d3826e616d1
-
SHA256
689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9
-
SHA512
be5c11d73fd0c8edf0a1d89c79fd2847511efdc401fe057624c0de67a01d1047b2c76f636733d71c46557c4b6d855ec37694fccf368ee8057901662b4a38adfb
-
SSDEEP
49152:ZlqwRsD6EZq9NBN8EFWI6xuPFT4u6Dr1LJPMxi:ZlqwRsOEiTVFM2T4FDt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
Files
-
689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe.exe windows:5 windows x86 arch:x86
dc4aa340f31b9e9d8005fb697ebfbf70
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
LoadLibraryA
SetLastError
GetNativeSystemInfo
lstrlenW
IsBadReadPtr
GetThreadLocale
GetTickCount
CloseHandle
ReadFile
GetFileSize
GetProcAddress
GetProcessHeap
DecodePointer
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
HeapSize
GetFullPathNameW
GetCurrentDirectoryW
FlushFileBuffers
GetConsoleCP
SetStdHandle
LCMapStringW
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetStringTypeW
HeapReAlloc
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
InitializeCriticalSection
Sleep
SleepEx
FormatMessageA
WaitForSingleObject
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
GetEnvironmentVariableW
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
MultiByteToWideChar
GetModuleHandleExW
WriteFile
LoadLibraryW
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
RtlUnwind
RaiseException
LoadLibraryExW
EncodePointer
GetModuleFileNameW
ExitProcess
GetACP
CreateThread
ExitThread
FreeLibrary
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wldap32
ord143
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46
shlwapi
PathFileExistsW
ws2_32
WSASetLastError
select
accept
WSAGetLastError
recv
WSAStartup
listen
ioctlsocket
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
gethostname
freeaddrinfo
recvfrom
WSACleanup
sendto
__WSAFDIsSet
advapi32
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 464KB - Virtual size: 463KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE