Static task
static1
Behavioral task
behavioral1
Sample
e261ca109358b3244e32550fa951a8a6e7d5150dd2c67c74748902da2ffbca6b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e261ca109358b3244e32550fa951a8a6e7d5150dd2c67c74748902da2ffbca6b.exe
Resource
win10v2004-20240709-en
General
-
Target
e261ca109358b3244e32550fa951a8a6e7d5150dd2c67c74748902da2ffbca6b
-
Size
170KB
-
MD5
4415e2bbc806aab120371e1b2aed148e
-
SHA1
647383818d35b8505b6783eefc475025eb5d2460
-
SHA256
e261ca109358b3244e32550fa951a8a6e7d5150dd2c67c74748902da2ffbca6b
-
SHA512
68509381cec5375f3e990e5309ab91fc02677f5808aebe15a184668b2ae617942b6f00a96018a9a5a47e4094be8e37d3fa0e6faba45651997d01e1f6ce54b286
-
SSDEEP
3072:E1UmLHri3HXt+TEkpkZLUuRjFD8RG1vrxDd5sBpYFBJBXETBS:KLL43t+TjSZLl5IRzYFpGS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource e261ca109358b3244e32550fa951a8a6e7d5150dd2c67c74748902da2ffbca6b
Files
-
e261ca109358b3244e32550fa951a8a6e7d5150dd2c67c74748902da2ffbca6b.exe windows:5 windows x86 arch:x86
413739bb49887becd6b6306e9a5edbd2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommProperties
GetModuleHandleW
ActivateActCtx
LoadLibraryW
GetAtomNameW
CreateJobObjectA
GetConsoleAliasesW
SetLastError
GetProcAddress
LoadLibraryA
SetVolumeMountPointW
UnhandledExceptionFilter
LocalAlloc
WritePrivateProfileStringA
OpenJobObjectW
FoldStringA
EnumDateFormatsA
lstrcatW
FreeEnvironmentStringsW
FindFirstVolumeW
AreFileApisANSI
WriteConsoleA
InterlockedDecrement
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
MultiByteToWideChar
SetStdHandle
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
FlushFileBuffers
ReadFile
CreateFileA
CloseHandle
advapi32
ReadEventLogA
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 565KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fayuf Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rutan Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ