Static task
static1
Behavioral task
behavioral1
Sample
73c83398e4c48140a17acf08103a4030f7b6318ef6da4c756fe6d8e6b7534d89.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
73c83398e4c48140a17acf08103a4030f7b6318ef6da4c756fe6d8e6b7534d89.exe
Resource
win10v2004-20240426-en
General
-
Target
73c83398e4c48140a17acf08103a4030f7b6318ef6da4c756fe6d8e6b7534d89
-
Size
2.6MB
-
MD5
15531098a1e14c613f0e5784c05b5b47
-
SHA1
63ec7feb17b81e989c3d43d01ab1e27f48c794ca
-
SHA256
73c83398e4c48140a17acf08103a4030f7b6318ef6da4c756fe6d8e6b7534d89
-
SHA512
9556999bc06698e5911a41bf86798621bdc58ab18cb45a813d90089e64470645485a55190edce62d59f9c63fbb653be64730a833f8935db9132e7e92b1019742
-
SSDEEP
49152:baWYr6RKkRu97UW+OSmdjlTCTYaBDV2VO:baV+DOS5P2VO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73c83398e4c48140a17acf08103a4030f7b6318ef6da4c756fe6d8e6b7534d89
Files
-
73c83398e4c48140a17acf08103a4030f7b6318ef6da4c756fe6d8e6b7534d89.exe windows:6 windows x64 arch:x64
b79b0cbed0f1f093158b35d987045e6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
SystemFunction036
kernel32
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
CreateFileW
GetFullPathNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetModuleFileNameW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
CreateNamedPipeW
ReadFileEx
SleepEx
WriteFileEx
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
bcrypt
BCryptGenRandom
ntdll
RtlNtStatusToDosError
NtWriteFile
vcruntime140
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
memcmp
memset
memmove
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_configure_narrow_argv
_initterm_e
_initterm
_seh_filter_exe
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_set_app_type
__p___argc
exit
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ