Static task
static1
Behavioral task
behavioral1
Sample
957e407af623ac2b3723a96730bbd788b803e47e422c632293e38208e170bf5f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
957e407af623ac2b3723a96730bbd788b803e47e422c632293e38208e170bf5f.exe
Resource
win10v2004-20240508-en
General
-
Target
957e407af623ac2b3723a96730bbd788b803e47e422c632293e38208e170bf5f
-
Size
7.0MB
-
MD5
1a3d4c3f1045b21c5d419dff5062513b
-
SHA1
70e3956f25a67db3b3f11104a47ee9f474a23ce2
-
SHA256
957e407af623ac2b3723a96730bbd788b803e47e422c632293e38208e170bf5f
-
SHA512
bb6e0a3bb805d717faa06d818a859a842a2badcd5474571b9cdcdd2ad68c0952939f6903ffb80093d8496a552a5e034251d6bf2f0fbd75153953f39c8f5ac151
-
SSDEEP
98304:zri0btKWcltJzGUVi1iaWm+3Vk+6Gz6aAUyq7FYMjC4k0JRK7rRZ9rBb:/ietKxPzRM1314VkFGDFTBJeBb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 957e407af623ac2b3723a96730bbd788b803e47e422c632293e38208e170bf5f
Files
-
957e407af623ac2b3723a96730bbd788b803e47e422c632293e38208e170bf5f.exe windows:5 windows x86 arch:x86
ef8ded4a62e1e5385f8684f90f907a86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
GetCurrentProcessId
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetUpdateRect
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
comdlg32
GetOpenFileNameA
shell32
ShellExecuteA
DragQueryFileA
gdi32
DeleteObject
CreateDIBitmap
msvcrt
_strnicmp
shlwapi
PathFileExistsA
advapi32
RegOpenKeyExA
ole32
CreateStreamOnHGlobal
oleaut32
VariantInit
iphlpapi
GetAdaptersInfo
ws2_32
WSAStartup
comctl32
InitCommonControlsEx
gdiplus
GdipGetPropertyItem
imm32
ImmGetContext
wtsapi32
WTSSendMessageW
Sections
69iZS"p+ Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
]O1oPejY Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
m)PNy%[z Size: - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IT:WV=mJ Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Z[e61-Tt Size: - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
jyBfb6\h Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
r=MAyW<& Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
8ZrQga?D Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
;Hsolr/G Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Y2(m=m8/ Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
upOjt1@M Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
A^v&a82l Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ