Static task
static1
Behavioral task
behavioral1
Sample
0248956b5c096f2dd46c5b4a36a77c20N.exe
Behavioral task
behavioral2
Sample
0248956b5c096f2dd46c5b4a36a77c20N.exe
General
-
Target
0248956b5c096f2dd46c5b4a36a77c20N.exe
-
Size
252KB
-
MD5
0248956b5c096f2dd46c5b4a36a77c20
-
SHA1
c0244c1403598243d422bf3a98b43c136140293d
-
SHA256
271a4dbd366c26d38f98f5b8cbc1605cf13c28f99083baf4e1df19868bbc5bdc
-
SHA512
1a6c0777f3cd1d7537b4216743f9b37a443280677ec8b52c6375595ae91d30b7029a0d571e1f3090ce0af84884d1954610ab264ef5b38e1a6d6e0af0e55f775b
-
SSDEEP
3072:U841XY81m8yWovU22dkXVbpGdHsGL+e7kCZcaMe4n4lYvQd2a:UlQSOVk9JrZ8e4nRa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0248956b5c096f2dd46c5b4a36a77c20N.exe
Files
-
0248956b5c096f2dd46c5b4a36a77c20N.exe.exe windows:5 windows x86 arch:x86
b2897279794e8cf81fbc0ba2986eced7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
FindNextFileA
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
CreateMutexA
GetLastError
CloseHandle
Sleep
CreateDirectoryA
WaitForSingleObject
TerminateThread
GetTickCount
CreateFileA
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
SetFileAttributesA
ExitProcess
SetLastError
CreateProcessA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
IsWow64Process
GetCurrentProcess
InterlockedDecrement
WideCharToMultiByte
SetEndOfFile
CreateFileW
SetEnvironmentVariableA
ReadConsoleW
WriteConsoleW
SetStdHandle
LoadLibraryW
OutputDebugStringW
SetFilePointer
HeapReAlloc
GetOEMCP
IsValidCodePage
GetACP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
FlushFileBuffers
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
GetFileType
GetProcessHeap
InterlockedIncrement
EncodePointer
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
GetStringTypeW
lstrlenA
LocalFree
HeapFree
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
AreFileApisANSI
HeapSize
user32
GetForegroundWindow
GetShellWindow
GetWindowRect
GetCursorPos
GetSystemMetrics
GetDesktopWindow
ole32
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
oleaut32
SysAllocString
SysFreeString
VariantClear
ws2_32
send
closesocket
WSACleanup
connect
htons
gethostbyname
socket
WSAStartup
recv
WSAGetLastError
Sections
.text Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ