Static task
static1
Behavioral task
behavioral1
Sample
hW1V9m4I.exe
Resource
win10v2004-20240508-en
General
-
Target
hW1V9m4I.exe
-
Size
20.4MB
-
MD5
14246c2a64a2015b949f3f8e19961797
-
SHA1
722335568fe4ff63808c583773d4ce373b666d35
-
SHA256
3821d7b22da971dab42a8cda7fffe63c19e1741a8d6ca52f3471177d8dcca558
-
SHA512
008b6cef08e2be0c50c8c10b0bb40706577ca4e4edcd62ada0eedabcaf2fc7c50ac8545ef07e3895ee1b12dda12bb93eea15fb4c2c4d0cdcdf311451bf9664e6
-
SSDEEP
393216:jg/MP/FoeVjwEFxCN6sIj/9NESGZcNmhRZfLXUEyRbh9KD3:zFoijw1NiTEBckhR5XQbeD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hW1V9m4I.exe
Files
-
hW1V9m4I.exe.exe windows:6 windows x64 arch:x64
c27005190595bea62c8fd6e20a4ee5be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateMutexA
user32
GetWindowThreadProcessId
gdi32
CreateCompatibleBitmap
advapi32
RegSetKeyValueW
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
VariantInit
shlwapi
PathFileExistsW
gdiplus
GdiplusStartup
ntdll
RtlInitUnicodeString
ws2_32
htons
comctl32
ImageList_Create
uxtheme
SetWindowTheme
Sections
.text Size: - Virtual size: 599KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 14.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20.4MB - Virtual size: 20.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 741B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ