Static task
static1
Behavioral task
behavioral1
Sample
f1c100b274086377cc1d5e1a76daa86e94980b3af2e5692ab6491848a5c58edb.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f1c100b274086377cc1d5e1a76daa86e94980b3af2e5692ab6491848a5c58edb.exe
Resource
win10v2004-20240426-en
General
-
Target
f1c100b274086377cc1d5e1a76daa86e94980b3af2e5692ab6491848a5c58edb
-
Size
3.5MB
-
MD5
8ea2a13397d1ece037a6897be71a18fa
-
SHA1
e24358745b12db4e640ccb93eb6049608bdba99c
-
SHA256
f1c100b274086377cc1d5e1a76daa86e94980b3af2e5692ab6491848a5c58edb
-
SHA512
2bb4b55270f8a37e96d67131aa48f915fea3e6820137ef4357c00f73d8ae492ccc08225ae4b122927b11dec4235edb8c4a312b51e8dca86e12689e73a5d9ba13
-
SSDEEP
49152:BX2YCnXYXS5nkuJE+fHsDqVkZP+neR/QFwXZfTb2AIO+e12gqiR7GjfpbM/+Vod/:BmNXYXOnkuJfLVkyFWZ7HLZyjfpbAn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1c100b274086377cc1d5e1a76daa86e94980b3af2e5692ab6491848a5c58edb
Files
-
f1c100b274086377cc1d5e1a76daa86e94980b3af2e5692ab6491848a5c58edb.exe windows:4 windows x86 arch:x86
a36eb08e04372ee396bb0321e26f6d9d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
VirtualFree
VirtualProtect
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
WriteFile
CloseHandle
GetLocalTime
VirtualQuery
CreateFileMappingW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
GetSystemInfo
VirtualProtectEx
user32
wsprintfA
shlwapi
ord158
msvbvm60
EVENT_SINK_GetIDsOfNames
__vbaStrI2
__vbaLateIdCall
__vbaVarIndexStore
__vbaLineInputVar
__vbaStrCat
__vbaInStrVarB
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
__vbaVarTstLe
__vbaVarCmpGe
__vbaStrBool
__vbaI4Abs
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
__vbaFpR4
__vbaStrFixstr
__vbaFpR8
__vbaErase
__vbaFileClose
__vbaVarAbs
__vbaExitEachColl
__vbaStrCmp
__vbaObjVar
__vbaVarLateMemSt
__vbaStrR8
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaVarMul
__vbaStrToUnicode
__vbaDateStr
__vbaVarDiv
ord608
__vbaVarCmpLe
__vbaInStrVar
__vbaUbound
__vbaVarCat
__vbaCheckType
_CIlog
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
__vbaVarSetObj
__vbaVarNot
_adj_fdivr_m32
__vbaVarTstNe
__vbaAryLock
__vbaStrToAnsi
__vbaFpI2
__vbaVarTstGe
__vbaCastObj
__vbaVarNeg
_allmul
_CItan
__vbaFPInt
Sections
.text Size: - Virtual size: 13.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vdata0 Size: - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vdata1 Size: - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.virbox3 Size: 220KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ