Static task
static1
Behavioral task
behavioral1
Sample
9d6711737d725c1fe790784801fd0d45b9792ab715dcc48c7a221d581e938c75.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9d6711737d725c1fe790784801fd0d45b9792ab715dcc48c7a221d581e938c75.exe
Resource
win10v2004-20240508-en
General
-
Target
9d6711737d725c1fe790784801fd0d45b9792ab715dcc48c7a221d581e938c75
-
Size
508KB
-
MD5
6237a619c3a5ac8ef79b76fb0c14f087
-
SHA1
dbf91785db0230ea3d2a2da6a395284286245787
-
SHA256
9d6711737d725c1fe790784801fd0d45b9792ab715dcc48c7a221d581e938c75
-
SHA512
9dd3bc08dc029ceae8e75395755896cc277611c9982148b8165ad658836e7439f03cf97d4552b4997e0793a950ccaa6ac96fc564af063f6ca6250e90c1f5d314
-
SSDEEP
6144:WW0J07EHxsWKKCbrZXDbI33z5P/kjguInr39tAOLPvI1ILz:t4CWKKCrZTGF/k8uMxtxPvvz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d6711737d725c1fe790784801fd0d45b9792ab715dcc48c7a221d581e938c75
Files
-
9d6711737d725c1fe790784801fd0d45b9792ab715dcc48c7a221d581e938c75.exe windows:4 windows x86 arch:x86
049cd5c61c56b1b627f941860ff6c3c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
GetLocalTime
GetTempPathA
OpenFileMappingA
CreateToolhelp32Snapshot
QueryDosDeviceA
OpenProcess
GetPrivateProfileStringA
Process32NextW
MapViewOfFile
GetLogicalDriveStringsA
UnmapViewOfFile
Process32FirstW
CloseHandle
GetTickCount
DeleteFileA
LockResource
SizeofResource
CreateFileA
MultiByteToWideChar
LoadResource
WaitForSingleObject
CreateProcessA
FindResourceA
GetModuleHandleA
InitializeCriticalSection
WriteFile
GetVersionExA
GetFileSize
GetFileAttributesW
ReadFile
WideCharToMultiByte
GetCurrentDirectoryW
SetFilePointer
SystemTimeToFileTime
CreateDirectoryW
LocalFileTimeToFileTime
SetFileTime
CreateFileW
CreateEventA
WaitNamedPipeA
SetEvent
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
Sleep
OutputDebugStringA
EnterCriticalSection
GetModuleFileNameA
GetFileAttributesA
SetUnhandledExceptionFilter
GetEnvironmentStrings
LeaveCriticalSection
LoadLibraryA
GetWindowsDirectoryA
FreeEnvironmentStringsA
FlushFileBuffers
lstrlenA
GetThreadLocale
SetEndOfFile
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetProcessHeap
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetProcAddress
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
user32
wsprintfA
LoadStringA
advapi32
RegSetValueExA
RegCreateKeyA
RegCloseKey
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
oleaut32
VariantClear
SysAllocStringLen
SysFreeString
SysAllocString
psapi
GetProcessImageFileNameA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
iphlpapi
GetAdaptersInfo
wininet
HttpSendRequestA
InternetOpenA
InternetConnectA
InternetReadFile
HttpOpenRequestA
InternetCloseHandle
InternetQueryOptionA
InternetSetOptionA
HttpQueryInfoA
Sections
.text Size: 368KB - Virtual size: 367KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ