Static task
static1
Behavioral task
behavioral1
Sample
d85cc9daba2c1b5a439e8df523a56ebcef2eb5fdabd94485707b3903c4c8f4cc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d85cc9daba2c1b5a439e8df523a56ebcef2eb5fdabd94485707b3903c4c8f4cc.exe
Resource
win10v2004-20240508-en
General
-
Target
d85cc9daba2c1b5a439e8df523a56ebcef2eb5fdabd94485707b3903c4c8f4cc
-
Size
66KB
-
MD5
9fb2158d827aac2f08636b38086dc450
-
SHA1
95f86fa9b8682214db744d80c095f086c55ad251
-
SHA256
d85cc9daba2c1b5a439e8df523a56ebcef2eb5fdabd94485707b3903c4c8f4cc
-
SHA512
d855e55543cb7ab70ac398fd8f42b43717472c777fc4e2641212453df06f5333db587739baece90b4738f4b7f63f509c2f6304cd96011371ae9585442b807384
-
SSDEEP
768:6B7HBXFw82t2C80lyaZ4jX05Rfw/MKPsED3VK2+ZtyOjgO4r9vFAg2rqs4mkesFF:u7HZFwzlyaZTQkKYTjipvF2TZ0Ff/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d85cc9daba2c1b5a439e8df523a56ebcef2eb5fdabd94485707b3903c4c8f4cc
Files
-
d85cc9daba2c1b5a439e8df523a56ebcef2eb5fdabd94485707b3903c4c8f4cc.exe windows:5 windows x86 arch:x86
719981e4a07a182166e9d536a1267a59
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenThread
CloseHandle
Thread32First
CreateToolhelp32Snapshot
LocalFree
Sleep
GetModuleFileNameA
GetModuleHandleA
GetCommandLineA
GetCurrentProcess
GetVersionExA
SetEvent
OpenEventA
ExitProcess
GetCurrentProcessId
LocalAlloc
WinExec
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
CreateMutexA
SuspendThread
GetTickCount
FlushFileBuffers
WriteFile
CreateFileA
ReadFile
GetFileSize
FindClose
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
Process32Next
Process32First
GetStartupInfoA
GetWindowsDirectoryA
DeleteFileA
GetSystemDirectoryA
GetTempPathA
CopyFileA
CreateEventA
MoveFileA
Thread32Next
FreeLibrary
IsBadReadPtr
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
VirtualQuery
GetLastError
FindResourceA
LoadResource
GetCommandLineW
LockResource
IsProcessorFeaturePresent
user32
LockWorkStation
UnregisterClassA
wsprintfA
RegisterWindowMessageA
GetClipboardFormatNameA
RegisterClassExA
SendInput
advapi32
OpenProcessToken
AllocateAndInitializeSid
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
SetSecurityDescriptorSacl
FreeSid
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
CheckTokenMembership
CreateWellKnownSid
shell32
CommandLineToArgvW
ord680
imagehlp
CheckSumMappedFile
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ