Static task
static1
Behavioral task
behavioral1
Sample
b0d5ea3badf2b0486ba76c16132f5cadb44529da0c9aa39586add64ebc6a5fbf.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b0d5ea3badf2b0486ba76c16132f5cadb44529da0c9aa39586add64ebc6a5fbf.exe
Resource
win10v2004-20240226-en
General
-
Target
b0d5ea3badf2b0486ba76c16132f5cadb44529da0c9aa39586add64ebc6a5fbf
-
Size
911KB
-
MD5
275f223fde69bdb48707a9d0e499316d
-
SHA1
cf8b33a614572aa4a21fe4f4ce4cedb536fde68b
-
SHA256
b0d5ea3badf2b0486ba76c16132f5cadb44529da0c9aa39586add64ebc6a5fbf
-
SHA512
ac68a23bc30276366ce6835c38ef162e89169a97952e39ad24c049c485aaa7bd058a062eafbb2ec43c34294c7bee967daa2ca65123ab99f0f4a5d5b70d676838
-
SSDEEP
24576:LTxLPdS+aJi+3VL4krESc2k9tnA/N30OMV:ntP8H/SkQS7krnA90O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0d5ea3badf2b0486ba76c16132f5cadb44529da0c9aa39586add64ebc6a5fbf
Files
-
b0d5ea3badf2b0486ba76c16132f5cadb44529da0c9aa39586add64ebc6a5fbf.exe windows:6 windows x64 arch:x64
5e56ef41f98e6726a99b9569236dff34
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
libeay32
ord223
ord227
ord467
ord464
ord962
ord2927
ord333
ord323
ord3019
ord256
ord961
ord2656
ord266
ord3067
ord2660
ord276
ord2894
iphlpapi
GetAdaptersAddresses
GetIpForwardTable
GetIpAddrTable
SendARP
advapi32
RegisterEventSourceA
DeregisterEventSource
ReportEventA
kernel32
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
GetModuleHandleExW
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetEndOfFile
GetFileType
GetModuleFileNameW
ReadFile
WriteFile
GetTimeZoneInformation
GetCommandLineA
GetCommandLineW
TlsSetValue
RtlUnwind
GetLastError
LocalFree
FormatMessageA
CloseHandle
CreateThread
GetStdHandle
WaitForSingleObject
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetModuleHandleA
GetProcAddress
WriteConsoleW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
ScrollConsoleScreenBufferA
Sleep
GetFileAttributesExA
CreateFileA
DeviceIoControl
GetSystemTimeAsFileTime
DeleteCriticalSection
HeapReAlloc
HeapSize
CreateFileW
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetCPInfo
OutputDebugStringW
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
LeaveCriticalSection
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
HeapAlloc
wsock32
__WSAFDIsSet
gethostname
recvfrom
WSAGetLastError
send
ntohs
connect
recv
WSACleanup
WSAStartup
socket
setsockopt
sendto
gethostbyname
ntohl
inet_addr
ioctlsocket
htons
htonl
closesocket
bind
select
user32
MessageBeep
ole32
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantClear
VariantInit
SafeArrayDestroy
SafeArrayCreate
SysFreeString
SysAllocString
Sections
.text Size: 589KB - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 563KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ