Static task
static1
Behavioral task
behavioral1
Sample
1c33d90da3f7c5bb69be3845c96b2f458fbcbd8f7b22a4735f800b901de2f9d1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1c33d90da3f7c5bb69be3845c96b2f458fbcbd8f7b22a4735f800b901de2f9d1.exe
Resource
win10v2004-20240508-en
General
-
Target
1c33d90da3f7c5bb69be3845c96b2f458fbcbd8f7b22a4735f800b901de2f9d1
-
Size
387KB
-
MD5
d4aa374d6803840683a4f40aa066878c
-
SHA1
ced4b35aa4365ed03ce5864a3cdc021ba3b62a2d
-
SHA256
1c33d90da3f7c5bb69be3845c96b2f458fbcbd8f7b22a4735f800b901de2f9d1
-
SHA512
68e947a90859c9319612b143dcd52d06fa12e8a104b78366cfaa9cc9cd1968ae31aec79abe34f6cf3217bc3864f7b965dbf5280210f204ca882f64413ba4b319
-
SSDEEP
12288:BSdfdZjfZoXjBJneybJBZfdJhXDmrqnu:DjBJnbbJBZfdJdmr+u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c33d90da3f7c5bb69be3845c96b2f458fbcbd8f7b22a4735f800b901de2f9d1
Files
-
1c33d90da3f7c5bb69be3845c96b2f458fbcbd8f7b22a4735f800b901de2f9d1.exe windows:5 windows x86 arch:x86
e01d3c2625f1ad7386d49510932f2db5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
SetEvent
WaitForSingleObject
Process32NextW
ProcessIdToSessionId
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
CreateThread
CreateEventW
CreateMutexW
Sleep
WriteFile
GetLastError
CloseHandle
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
ReadFile
GetFileSize
CreateFileW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetFilePointer
GetLocalTime
MoveFileW
ReleaseMutex
OutputDebugStringW
GetModuleFileNameW
GetUserDefaultLangID
OpenMutexW
MultiByteToWideChar
GetCurrentProcessId
InterlockedDecrement
FlushFileBuffers
GetModuleHandleW
lstrlenA
LoadLibraryExW
GetProcAddress
LoadLibraryA
InterlockedIncrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
IsBadReadPtr
CreateDirectoryW
GetFileAttributesW
LoadLibraryW
GetVersionExW
GetSystemInfo
LocalFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetStringTypeW
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
advapi32
OpenServiceW
SetServiceStatus
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceCtrlDispatcherW
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
ChangeServiceConfigW
QueryServiceConfigW
CloseServiceHandle
RegisterServiceCtrlHandlerExW
wtsapi32
WTSEnumerateSessionsW
userenv
CreateEnvironmentBlock
psapi
GetModuleFileNameExW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
shell32
SHGetSpecialFolderPathW
oleaut32
VariantClear
SysFreeString
SysAllocString
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VariantInit
Sections
.text Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ