Behavioral task
behavioral1
Sample
d8cfde3d37ff0ca46d5edbb6331647c91b93cbe3e61fea2ae364949cc5ca060f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d8cfde3d37ff0ca46d5edbb6331647c91b93cbe3e61fea2ae364949cc5ca060f.exe
Resource
win10v2004-20240508-en
General
-
Target
d8cfde3d37ff0ca46d5edbb6331647c91b93cbe3e61fea2ae364949cc5ca060f
-
Size
12.8MB
-
MD5
d740e782a45756aafd5ec5a816981f75
-
SHA1
1839edaf725f9d0f7d0f9d10e0ef91907acb54cd
-
SHA256
d8cfde3d37ff0ca46d5edbb6331647c91b93cbe3e61fea2ae364949cc5ca060f
-
SHA512
d2e871d8f7e2d5a31658a5c0faeb5dadba9336afa36225f25fb84520831705352937382b5c1ab327e2b5ba727d6a125de809d84b51b8150eb18914b8869231f7
-
SSDEEP
196608:RotZgs21BRldoQlSOLM8gYQzBjS5JHcd9slutXK/CqFju:RotZoBRU0tL9gYQMhcMluc/CCu
Malware Config
Signatures
-
resource yara_rule sample detect_ak_stuff -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8cfde3d37ff0ca46d5edbb6331647c91b93cbe3e61fea2ae364949cc5ca060f
Files
-
d8cfde3d37ff0ca46d5edbb6331647c91b93cbe3e61fea2ae364949cc5ca060f.exe windows:5 windows x86 arch:x86
de0a8c107657b2cd45cce3c53f42507d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
gdi32
UnrealizeObject
version
VerQueryValueW
mpr
WNetGetConnectionA
ole32
CreateStreamOnHGlobal
comctl32
_TrackMouseEvent
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
wsock32
WSACleanup
gdiplus
GdipSetStringFormatLineAlign
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
winmm
waveOutRestart
ws2_32
select
winspool.drv
OpenPrinterA
Sections
.text Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.2048 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.2048 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ