Static task
static1
Behavioral task
behavioral1
Sample
848b99f416e814b696bc45a613ed01bd2c52d0a39010b6775a3461df029ecd2c.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
848b99f416e814b696bc45a613ed01bd2c52d0a39010b6775a3461df029ecd2c.exe
Resource
win10v2004-20240709-en
General
-
Target
848b99f416e814b696bc45a613ed01bd2c52d0a39010b6775a3461df029ecd2c
-
Size
3.1MB
-
MD5
fa82ffe2e8c7f05dc3273017848e87e1
-
SHA1
89a96023b4cd365ace5f4f53af683af23c99e50c
-
SHA256
848b99f416e814b696bc45a613ed01bd2c52d0a39010b6775a3461df029ecd2c
-
SHA512
0fef6ce59988befaad127a9f64209da48b14a480587b12aa7ade0c6b1229882dc361638813a364a0cce1c2a8b7d7b4481a2afbaaa7f6864123c79bfc0f88f57d
-
SSDEEP
49152:i/r8qR/m2nZaiDVR3MFpH0h8omQk7amu+Rz04pzpsv5UypyD8mF7LjLypVcT0uRr:iz8V2ZaI8omuEz0H0wmNLUVWAO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 848b99f416e814b696bc45a613ed01bd2c52d0a39010b6775a3461df029ecd2c
Files
-
848b99f416e814b696bc45a613ed01bd2c52d0a39010b6775a3461df029ecd2c.exe windows:6 windows x86 arch:x86
5ad7185f81897084247ecb4320ef9223
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
GetTokenInformation
GetSidSubAuthority
GetUserNameW
IsValidSid
GetSidSubAuthorityCount
OpenProcessToken
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
SetEntriesInAclW
AllocateAndInitializeSid
FreeSid
GetSecurityInfo
SetSecurityInfo
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
user32
GetSystemMetrics
kernel32
GetCurrentProcess
CloseHandle
GetCurrentProcessId
ProcessIdToSessionId
GetProcAddress
FreeLibrary
GetVolumeInformationA
GetModuleHandleA
GetEnvironmentVariableA
SetLastError
GetVersionExA
GetCurrentThreadId
Sleep
GetSystemTime
SystemTimeToFileTime
OpenProcess
GetProcessTimes
GetFileInformationByHandle
CreateFileW
LocalFree
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
VirtualProtect
ResumeThread
OutputDebugStringA
OpenMutexA
GetModuleFileNameW
LoadLibraryExW
GetCommandLineW
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
ReadFile
WriteFile
InterlockedDecrement
InterlockedCompareExchange
InterlockedIncrement
GetModuleFileNameA
LocalAlloc
MultiByteToWideChar
GetComputerNameW
DeviceIoControl
CreateFileA
GetSystemInfo
DefineDosDeviceA
QueryDosDeviceA
SetFileAttributesW
CreateDirectoryW
TlsAlloc
TlsSetValue
TlsGetValue
GetSystemTimeAsFileTime
IsBadReadPtr
CreateMutexA
DuplicateHandle
ReleaseMutex
WaitForSingleObject
GetDriveTypeA
GetLogicalDrives
GetTickCount
GetSystemDirectoryA
LoadLibraryExA
GetComputerNameExW
FindFirstFileW
TerminateProcess
GetTimeZoneInformation
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
CreateThread
SetThreadPriority
TerminateThread
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
DeleteFileW
RemoveDirectoryW
MoveFileExW
SetFilePointerEx
SetEndOfFile
SwitchToThread
FindNextFileW
SetEvent
CreateEventA
ExitProcess
GetStartupInfoA
GetCommandLineA
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsFree
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 165KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ