Static task
static1
Behavioral task
behavioral1
Sample
663f143e7a6c503b2940ec8ae584fdf1ef163d8ed4b25e9a005e52b16931d349.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
663f143e7a6c503b2940ec8ae584fdf1ef163d8ed4b25e9a005e52b16931d349.exe
Resource
win10v2004-20240611-en
General
-
Target
663f143e7a6c503b2940ec8ae584fdf1ef163d8ed4b25e9a005e52b16931d349
-
Size
2.8MB
-
MD5
6f7350b2b6bce0c08fc8d0c70cb419ff
-
SHA1
68262b792b17ea2dd03bf782cc0aca115da31082
-
SHA256
663f143e7a6c503b2940ec8ae584fdf1ef163d8ed4b25e9a005e52b16931d349
-
SHA512
b815801e2b5ccc5d415c72ebdbc3d1e0472ac2823888a83eabd274367ff8bfc06084a95a389d062d67c2d22dc2a0b59962735d22dd9aa328e4829b2454c5a507
-
SSDEEP
49152:JYFwmyZ7R2HDUYjBVkVi423GgPeVTNeeX0Ew+A13YDcqVAxBOp1B07sjsPEtd2z5:cP6iHGnTNeeX0r+oYDc6AbOp1S7sjXqm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 663f143e7a6c503b2940ec8ae584fdf1ef163d8ed4b25e9a005e52b16931d349
Files
-
663f143e7a6c503b2940ec8ae584fdf1ef163d8ed4b25e9a005e52b16931d349.exe windows:5 windows x86 arch:x86
693baf86da55b9d8243930e2be96f095
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateFileW
GetVersionExW
GetSystemDirectoryW
GetLastError
LockResource
CloseHandle
LoadResource
FindResourceW
LocalFree
GetComputerNameW
CreateProcessW
GetExitCodeProcess
GetModuleFileNameW
CreateMutexW
ReleaseMutex
SetFileAttributesW
CopyFileW
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetFileSize
ReadFile
WriteFile
SetFilePointer
SetFileTime
GetFileInformationByHandle
GetStdHandle
GetCurrentProcessId
GetCurrentThreadId
SetLastError
GetModuleHandleW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
GetModuleHandleA
FindFirstFileW
VirtualAlloc
VirtualFree
ReadConsoleW
WriteConsoleW
GetVolumeInformationW
SizeofResource
WideCharToMultiByte
DeleteFileW
MultiByteToWideChar
SetEndOfFile
GetTempPathW
GetTimeZoneInformation
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RaiseException
RtlUnwind
LoadLibraryExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapReAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFullPathNameW
SetStdHandle
user32
CharUpperW
advapi32
ConvertSidToStringSidW
LookupAccountNameW
shell32
ShellExecuteW
SHCreateDirectoryExW
SHGetFolderPathW
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen
shlwapi
PathFileExistsW
Sections
.text Size: 330KB - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ