Static task
static1
Behavioral task
behavioral1
Sample
11cd1472cd1cc75245a148d4e9560bf7f7917443b36dec3f92ed79b8e743b399.exe
Resource
win7-20240705-en
General
-
Target
f8ae25eb2bef827759f8cd837ad85bda.bin
-
Size
351KB
-
MD5
bf86b8769828fa3c399b0d6b71a0e4b3
-
SHA1
cb08ae2cdf1a237e75c3eea10e9a0048d336ed58
-
SHA256
d9756fff1fe809c146010f3c59e51dda08ebbda643a6becc9732104bc4632bff
-
SHA512
4dc66d61ec3ae040fb99584377f976f26f06ce3411ff9d037ed2ffb228e4f3cbb268e4b0376a4e387239f47e3ccf9b023b46cd255a63b7811e7fb0fc56e64ce8
-
SSDEEP
6144:130+6Qf2/9XIsQnpyJHHVfRA+x//Irt/1y3QUIYl2X9tdsWrqO5jQA7Q:139f2/isQkPdIt/I5utViA7Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/11cd1472cd1cc75245a148d4e9560bf7f7917443b36dec3f92ed79b8e743b399.exe
Files
-
f8ae25eb2bef827759f8cd837ad85bda.bin.zip
Password: infected
-
11cd1472cd1cc75245a148d4e9560bf7f7917443b36dec3f92ed79b8e743b399.exe.exe windows:6 windows x64 arch:x64
Password: infected
9a5829c39073c30fe14404256cbdd15c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
GetSystemMetrics
GetDC
GetDesktopWindow
wsprintfW
GetClientRect
wsprintfA
advapi32
GetUserNameA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
GetCurrentHwProfileA
gdi32
CreateCompatibleDC
SelectObject
DeleteObject
CreateCompatibleBitmap
BitBlt
gdiplus
GdipGetImageEncodersSize
GdipAlloc
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipSaveImageToFile
GdipFree
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
shlwapi
StrCmpIW
PathFindExtensionW
PathFileExistsW
shell32
ShellExecuteExW
kernel32
IsValidLocaleName
EnumSystemLocalesEx
SetStdHandle
WriteConsoleW
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
SetEnvironmentVariableA
SetEndOfFile
InitializeCriticalSectionEx
LCMapStringEx
GetSystemInfo
GetUserDefaultLocaleName
CompareStringEx
OutputDebugStringW
LoadLibraryExW
GetStringTypeW
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
SetFilePointer
ReadConsoleW
GetConsoleMode
HeapSize
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
FindNextFileW
GlobalLock
GlobalAlloc
GlobalUnlock
GetProcAddress
LoadLibraryA
GetFileSize
lstrlenA
HeapAlloc
GetProcessHeap
Sleep
ReadFile
CreateFileW
SetCurrentDirectoryW
CloseHandle
CreateProcessW
WriteFile
GetNativeSystemInfo
FreeLibrary
HeapFree
VirtualFree
IsBadReadPtr
SetLastError
VirtualAlloc
VirtualProtect
ExitProcess
GetModuleHandleW
RaiseException
GetLastError
DeleteFileW
CreateThread
GetComputerNameA
CreateDirectoryW
WaitForSingleObject
CopyFileW
GetLocaleInfoEx
FindClose
GlobalMemoryStatusEx
GetModuleFileNameA
GetUserDefaultUILanguage
GetVersionExA
GetSystemFirmwareTable
OpenProcess
LoadLibraryW
TerminateProcess
Process32FirstW
RemoveDirectoryW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileA
FindNextFileA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCommandLineW
EncodePointer
DecodePointer
GetCPInfo
HeapReAlloc
GetSystemTimeAsFileTime
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
GetModuleFileNameW
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
IsValidCodePage
GetACP
GetOEMCP
Sections
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ