Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240508-en
General
-
Target
1
-
Size
1.0MB
-
MD5
4d1d43789e038c6a03c07083ca0b0809
-
SHA1
8c4d87363a4a2352847923091b9ddfa6891f2807
-
SHA256
05edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
-
SHA512
32de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
-
SSDEEP
6144:rj7W89i5WWwR7A7XJfZ4FFhDhMWwR7A7XJVgNgG7:rjntWqA7X5Z+NMWqA7XOgG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1
Files
-
1.exe windows:5 windows x86 arch:x86
22dbb276300404135258818b9af1f7bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrStrIW
kernel32
GetModuleHandleW
VirtualFree
WriteFile
SizeofResource
ReadFile
CreateFileW
lstrlenW
GetLastError
GetProcAddress
VirtualAlloc
OpenThread
LockResource
lstrcmpiW
CreateToolhelp32Snapshot
GetCurrentProcess
CloseHandle
HeapAlloc
HeapCreate
OutputDebugStringW
ExitProcess
GetCommandLineW
MapViewOfFile
OpenProcess
LoadLibraryW
Sleep
GetModuleFileNameW
lstrcmpW
OpenMutexW
Process32FirstW
GetProcessId
IsWow64Process
CreateFileMappingW
Process32NextW
lstrcatW
DeleteFileW
lstrcpyW
CreateProcessW
LoadResource
FindResourceW
lstrlenA
SetFilePointer
GetFileSize
HeapFree
user32
wsprintfW
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
shell32
SHGetFolderPathW
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 666B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ