Static task
static1
Behavioral task
behavioral1
Sample
051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe
Resource
win10v2004-20240508-en
General
-
Target
051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00
-
Size
8.0MB
-
MD5
c909ca40d1124fc86662a12d72e0fb78
-
SHA1
75d7f88e010e5c7d9a4617157034cff16da0733f
-
SHA256
051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00
-
SHA512
c0c6ae4fad454ae1f1c083301813c97cb93995f80320f363d1fc7109b3fa310fbc3d62e7471366086df4cf460eba19d858a5545053755c453c33aa4654cd9556
-
SSDEEP
24576:LZtbvYMelZzxdJusjdLn+D02xlHt5fXyw8YZSXm8PCBnrVfTrelp/xlNSL+q:9hghvJusR+AKlDX6LKT6lp/xPSL+q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00
Files
-
051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00.exe windows:5 windows x86 arch:x86
cdd269415cf4f3a9ae32e8475a8a4667
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleCP
GetFileAttributesA
VerifyVersionInfoA
TerminateProcess
FileTimeToSystemTime
MultiByteToWideChar
FindFirstFileA
GetLastError
GetProcAddress
RemoveDirectoryA
SetFileAttributesA
FindClose
Process32Next
MoveFileA
FindNextFileA
GetModuleHandleA
IsDebuggerPresent
OpenProcess
CreateToolhelp32Snapshot
GetVersionExA
CloseHandle
GetVersion
DeleteFileA
lstrcpyA
GetCurrentDirectoryA
GetFullPathNameA
SetConsoleMode
ReadConsoleInputA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
ExitThread
GetWindowsDirectoryA
GetCurrentProcess
VerSetConditionMask
lstrlenA
CreateThread
GetTempPathA
OutputDebugStringA
VirtualAlloc
CreateDirectoryA
GetEnvironmentVariableA
Sleep
GetTickCount
WaitForSingleObject
GetComputerNameA
FlushConsoleInputBuffer
GlobalMemoryStatus
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
CreateFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
VirtualFree
HeapCreate
SetFilePointer
ReadFile
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
FreeLibrary
SetConsoleCtrlHandler
GetModuleFileNameA
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
LCMapStringW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
user32
GetWindowThreadProcessId
CharNextA
GetShellWindow
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
advapi32
RegisterEventSourceA
DeregisterEventSource
ReportEventA
GetUserNameA
shell32
ShellExecuteA
wininet
InternetReadFile
DeleteUrlCacheEntryA
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
ws2_32
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
shutdown
getaddrinfo
wldap32
ord41
ord46
ord27
ord301
ord33
ord35
ord32
ord200
ord30
ord26
ord211
ord50
ord60
ord143
ord22
ord79
Sections
.text Size: 1004KB - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 282KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ