Static task
static1
Behavioral task
behavioral1
Sample
141556669bca86c1c7ef4d8c47778928b0ec637194ddfdc389ccef9ad9b3ed89.exe
Resource
win10v2004-20240508-en
General
-
Target
141556669bca86c1c7ef4d8c47778928b0ec637194ddfdc389ccef9ad9b3ed89
-
Size
266KB
-
MD5
a797cd359bdfda31f0580804fd01f235
-
SHA1
95bed0af8274b664473aacd4275e0d00fb62b49c
-
SHA256
141556669bca86c1c7ef4d8c47778928b0ec637194ddfdc389ccef9ad9b3ed89
-
SHA512
c5ecd4a9355975d4d30ba9624e02ac27f6b34ce909f468ebcd92da47749ab3d960cb79c339fdadfc9495783077d106698060a003cfe2cb2f0007efe489346dcf
-
SSDEEP
3072:joZtxYCs3u2uM/y8y8NcXAGxWdEbe+CIOuenwtd9skwvVNHT19/:wcR3XtDGxWdEbeEHLMDT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 141556669bca86c1c7ef4d8c47778928b0ec637194ddfdc389ccef9ad9b3ed89
Files
-
141556669bca86c1c7ef4d8c47778928b0ec637194ddfdc389ccef9ad9b3ed89.exe windows:5 windows x86 arch:x86
fbfb2f7599ffcfbe8e56ac321b1a7a9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TzSpecificLocalTimeToSystemTime
AddConsoleAliasA
LoadLibraryExW
SetComputerNameA
GetUserDefaultLangID
GetSystemDefaultLangID
IsBadStringPtrA
CreateDirectoryW
InterlockedCompareExchange
lstrcatA
GetDefaultCommConfigA
GetTickCount
GetLastError
VirtualProtect
LocalAlloc
WriteProcessMemory
FoldStringA
SetLastError
GetWindowsDirectoryW
GetNumberFormatA
GetCalendarInfoA
GetModuleFileNameW
CreateFileW
WriteConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
IsValidLocale
SetConsoleTextAttribute
SetFileAttributesW
BuildCommDCBA
OpenEventA
GetProcAddress
LoadLibraryW
FindFirstVolumeMountPointW
GetACP
QueryInformationJobObject
LoadLibraryA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetSystemTimeAsFileTime
GetCurrentProcessId
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapFree
RtlUnwind
RaiseException
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetCurrentThreadId
HeapSize
ExitProcess
SetFilePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
CloseHandle
user32
LoadMenuW
GetUserObjectSecurity
DrawCaption
DdeQueryStringA
GetKeyNameTextA
GetWindowTextLengthA
CloseWindow
DdeCmpStringHandles
gdi32
GetPixelFormat
GdiComment
DeleteMetaFile
GetCharacterPlacementW
advapi32
RegOpenKeyW
ReadEventLogA
ReadEventLogW
CloseEventLog
RegisterEventSourceW
ole32
CoMarshalHresult
CoRegisterPSClsid
CoGetClassObject
winhttp
WinHttpCheckPlatform
WinHttpWriteData
msimg32
AlphaBlend
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 95KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nugex Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ