Static task
static1
Behavioral task
behavioral1
Sample
f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e.exe
Resource
win10v2004-20240611-en
General
-
Target
f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e.exe
-
Size
326KB
-
MD5
2d5a97f6333a2cd71869fd0796d60664
-
SHA1
6f0fc0ebba3e4c8b26a69cdf519edf8d1aa2f4bb
-
SHA256
f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e
-
SHA512
7916c0a69429b5df333d75f2e47d55d69708b190833865fa931b758914b06c5f3ff2c24bc6f5ea64d3ce73f01d1892272e3b602e5f661962f22e2db53058ff76
-
SSDEEP
6144:GpYcnvvOc5OE9Gdl8S+T4fyrzpAGLmonGRcKYoKYIKYlKYsKYwKYRKY0KYfKY64E:Gp73ZAEET8SMnLrGTq+HCuTyB2+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e.exe
Files
-
f2287ddc1376c1ffbf6652d06d115a42e041df1976b321142c0f92dbdb96e82e.exe.exe windows:5 windows x64 arch:x64
b85f45f30406ccb5396c9c4af864131e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualProtect
CreateProcessW
GetModuleFileNameW
GetProcAddress
LoadLibraryA
DeleteFileW
GetFileAttributesW
GetModuleHandleA
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFile
SetFilePointer
CreateFileMappingW
WriteFile
CreateMutexW
GetComputerNameW
GetVolumeInformationW
SleepEx
VirtualAlloc
VirtualFree
SetLastError
IsBadReadPtr
FreeLibrary
SetEvent
CreateEventW
CreateFileW
GetFileSize
ReadFile
HeapReAlloc
GetTickCount
HeapFree
GetProcessHeap
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
GetExitCodeThread
CreateThread
TerminateThread
CloseHandle
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetLastError
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DecodePointer
EncodePointer
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
LoadLibraryW
ExitThread
GetCurrentThreadId
GetCommandLineA
GetStartupInfoW
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSize
GetModuleHandleW
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
LCMapStringW
advapi32
RegEnumValueW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegisterEventSourceW
DeregisterEventSource
SetServiceStatus
RegQueryInfoKeyW
GetUserNameW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
ws2_32
WSAStartup
WSACleanup
iphlpapi
GetAdaptersAddresses
Sections
.text Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 80KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ