Static task
static1
Behavioral task
behavioral1
Sample
1e20d002896dea37f5d659e495f61895f9a287b3847c622cdb05cfc4da36f598.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1e20d002896dea37f5d659e495f61895f9a287b3847c622cdb05cfc4da36f598.exe
Resource
win10v2004-20240508-en
General
-
Target
1e20d002896dea37f5d659e495f61895f9a287b3847c622cdb05cfc4da36f598
-
Size
8.0MB
-
MD5
453bc2b22c453a174927f7366ee3f54b
-
SHA1
487851da0f8ee8ad17d35971d338f4dcdd065c9c
-
SHA256
1e20d002896dea37f5d659e495f61895f9a287b3847c622cdb05cfc4da36f598
-
SHA512
62a46235836442dc8c0ca2a6fbdaa110bed0e9a07c44dc6ab9190177265ce78d8dccf5ec780095e46500b03884312c24335e7510f53347244b59b927137cc06d
-
SSDEEP
196608:bwxXX4/DIR0dG9/QffsQV0ONHjglCZtHdsQbKE2Od7punriApD0Y:bwxXX4ER0Lffr0YHkUZrQEtd9QpD0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e20d002896dea37f5d659e495f61895f9a287b3847c622cdb05cfc4da36f598
Files
-
1e20d002896dea37f5d659e495f61895f9a287b3847c622cdb05cfc4da36f598.exe windows:6 windows x86 arch:x86
e47a94d2edba93c29293b55831d47d7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
GetCommandLineW
SetFilePointerEx
lstrlenW
AcquireSRWLockExclusive
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
GetLastError
GetCurrentProcess
DuplicateHandle
SwitchToThread
SetFileInformationByHandle
WaitForSingleObject
CopyFileExW
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
AcquireSRWLockShared
ReleaseSRWLockShared
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
SetLastError
CloseHandle
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
CreateDirectoryW
FindFirstFileW
FindClose
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcessId
HeapFree
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
HeapAlloc
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
GetCurrentDirectoryW
RtlCaptureContext
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
WaitForSingleObjectEx
GetProcessHeap
CompareStringW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
RaiseException
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
ntdll
NtCreateFile
RtlNtStatusToDosError
NtReadFile
NtWriteFile
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
Sections
.text Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7.7MB - Virtual size: 7.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ