Static task
static1
Behavioral task
behavioral1
Sample
6df3692eaaab610bba8364129f631391d949c7dd4fc3b1bfdfe3fd6d9e00923d.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6df3692eaaab610bba8364129f631391d949c7dd4fc3b1bfdfe3fd6d9e00923d.exe
Resource
win10v2004-20240426-en
General
-
Target
6df3692eaaab610bba8364129f631391d949c7dd4fc3b1bfdfe3fd6d9e00923d
-
Size
1.8MB
-
MD5
c25e2227416b60079fd08c233646e318
-
SHA1
e1569714f3dc64f9a71e43475567edcc2c2e7675
-
SHA256
6df3692eaaab610bba8364129f631391d949c7dd4fc3b1bfdfe3fd6d9e00923d
-
SHA512
247a6d4c304917b9718de864216884488ab81bcc39fda36dab4a2f9c319e03d927bbb73d2cd682e7e9a796f4d8d71ba21063ee6233d49784955db145c5bce890
-
SSDEEP
49152:wbGxQH2rUjA+7EfIOFjZKNZ/EmlPBYHgYMgPDUan4v2BZ/gHx:m9jvWIpNZsmlpClMgPz4OBZ4R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6df3692eaaab610bba8364129f631391d949c7dd4fc3b1bfdfe3fd6d9e00923d
Files
-
6df3692eaaab610bba8364129f631391d949c7dd4fc3b1bfdfe3fd6d9e00923d.exe windows:4 windows x86 arch:x86
48825e42160bef279c82e95e5d9f721d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
wcsstr
wcscmp
memmove
memcpy
_CIfmod
wcsncpy
wcslen
wcscat
kernel32
GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetEnvironmentVariableW
SetEnvironmentVariableW
GetModuleFileNameW
TlsAlloc
HeapAlloc
TlsSetValue
GetCurrentThreadId
GetTickCount
TlsGetValue
Sleep
WideCharToMultiByte
HeapFree
MultiByteToWideChar
HeapSize
FreeLibrary
LoadLibraryW
GetProcAddress
GetDriveTypeW
FindFirstFileW
FindClose
GetFileAttributesW
DeleteFileW
WriteFile
CreateFileW
SetFilePointer
ReadFile
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsFree
GetLastError
SetLastError
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore
user32
CharLowerW
winmm
timeBeginPeriod
timeEndPeriod
Sections
.code Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ