Static task
static1
Behavioral task
behavioral1
Sample
c34a74f986e84404a778f3ed2497ba469c09deb791946afa3a1f293effd3247c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c34a74f986e84404a778f3ed2497ba469c09deb791946afa3a1f293effd3247c.exe
Resource
win10v2004-20240426-en
General
-
Target
c34a74f986e84404a778f3ed2497ba469c09deb791946afa3a1f293effd3247c
-
Size
11.9MB
-
MD5
1da5da875b6cb57634a850a44b9296a1
-
SHA1
4b0f19d4ba3ee5ec20630a7cf7cc0885bb4f308f
-
SHA256
c34a74f986e84404a778f3ed2497ba469c09deb791946afa3a1f293effd3247c
-
SHA512
4c25ae42ca2a1407ed82992ffc1a69f3ce7d528b0e1ae74533db607ab3efd3294382ec8cb97be368074e339fdd2373ec9193c5e2458155cc636c0e933c73b167
-
SSDEEP
196608:KqGaJhPkYc399bbOFuxXsDYprXZguYYI2zaRAVcCBGOOR+Rgi7sLCbaDmLZy53rX:B7nPkY29piFnDEguYb2zevC2ysSfABX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c34a74f986e84404a778f3ed2497ba469c09deb791946afa3a1f293effd3247c
Files
-
c34a74f986e84404a778f3ed2497ba469c09deb791946afa3a1f293effd3247c.exe windows:4 windows x86 arch:x86
e060c4486f6b56c7f6c62bce7e4546ee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx
user32
wsprintfA
shlwapi
ord158
msvbvm60
__vbaVarTstGt
__vbaStrI2
__vbaR8ForNextCheck
__vbaStrVarMove
__vbaRecAnsiToUni
__vbaI4Sgn
__vbaVarTextTstEq
__vbaStrDate
__vbaHresultCheckObj
__vbaVargVarCopy
__vbaLenVar
__vbaLateMemSt
__vbaStrBool
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaStrFixstr
__vbaStrTextCmp
__vbaRefVarAry
ord631
__vbaErase
__vbaLateMemStAd
__vbaVarAbs
__vbaVarLateMemSt
__vbaNew
_CIsqrt
__vbaStrUI1
ord712
__vbaR4ErrVar
_adj_fprem
__vbaI2Str
ord608
__vbaVarCmpLe
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaVarCat
__vbaDateVar
__vbaLsetFixstrFree
ord645
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
__vbaI4Str
__vbaVarNot
_adj_fdivr_m32
__vbaVarTstNe
__vbaForEachAry
__vbaLateMemCall
__vbaVarDup
__vbaFpI2
__vbaRecDestructAnsi
_CIatan
__vbaCastObj
__vbaStrVarCopy
__vbaForEachVar
__vbaVarNeg
ord650
__vbaVarLateMemCallSt
__vbaAryRecCopy
__vbaFPInt
Sections
.text Size: - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox Size: - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vdata0 Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vdata1 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox3 Size: 220KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ