Static task
static1
Behavioral task
behavioral1
Sample
56009f4e2709e10a1cdfc3acb57eb930N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
56009f4e2709e10a1cdfc3acb57eb930N.exe
Resource
win10v2004-20240709-en
General
-
Target
56009f4e2709e10a1cdfc3acb57eb930N.exe
-
Size
185KB
-
MD5
56009f4e2709e10a1cdfc3acb57eb930
-
SHA1
4dfd0a1712e7de506a5e79f9a6bc9105ed5a7d93
-
SHA256
1cbc3a028daad20b3d9cf76291c56c9da34199beb5441654d6205cfde16cdd6b
-
SHA512
5b76a263e55ce4ccc51a93f0ceef0e78f5d00ac7a249c546fbc284f361cad7513a0a177ee3f3676e947347ef7620d78badac844aa6283a05267eee8b5fb5355b
-
SSDEEP
1536:YFjuGpFOG/vKYQJYI7s463zRQu/niwPinPtrQV4TsmkWp/hz7w0UtypDSFd:YA6MGPQJL7s46DyqhinI4/N/hzvPDS3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 56009f4e2709e10a1cdfc3acb57eb930N.exe
Files
-
56009f4e2709e10a1cdfc3acb57eb930N.exe.exe windows:4 windows x86 arch:x86
f372c0bc47fce47fa619674ce30680b3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
lstrcpyA
GetModuleFileNameA
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleHandleA
GetStartupInfoA
ExitProcess
DuplicateHandle
CreateProcessA
GetCurrentProcess
TerminateThread
GetExitCodeThread
DeleteCriticalSection
SetEvent
CloseHandle
GetVersionExA
GetLastError
CreateEventA
WaitForSingleObject
SuspendThread
ResumeThread
CreateThread
user32
DispatchMessageA
MessageBoxA
FindWindowA
GetSysColor
SetWindowLongA
SetDlgItemTextA
DestroyIcon
CreateWindowExA
TranslateMessage
DestroyWindow
GetMessageA
UpdateWindow
SendMessageA
LoadIconA
RegisterClassA
LoadCursorA
PostMessageA
DefWindowProcA
SetFocus
SetMenuDefaultItem
TrackPopupMenu
GetCursorPos
ShowWindow
CreatePopupMenu
SetForegroundWindow
DeleteMenu
DestroyMenu
AppendMenuA
WaitForInputIdle
GetSystemMenu
LoadImageA
PeekMessageA
PostQuitMessage
LoadStringA
gdi32
SetBkMode
CreateSolidBrush
GetStockObject
advapi32
RegOpenKeyExA
OpenServiceA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
SetServiceStatus
RegisterServiceCtrlHandlerA
CloseServiceHandle
QueryServiceStatus
OpenSCManagerA
StartServiceCtrlDispatcherA
RegCloseKey
RegQueryValueExA
shell32
Shell_NotifyIconA
comctl32
PropertySheetA
ord17
wsock32
socket
send
recv
htonl
getservbyname
htons
setsockopt
bind
listen
closesocket
WSAStartup
WSACleanup
accept
gds32
ord201
ord120
ord160
ord115
ord114
ord167
ord141
ord165
ord181
ord194
ord190
ord182
ord183
ord200
ord180
ord197
ord178
ord122
ord128
ord103
ord113
ord152
ord139
ord145
ord119
ord108
ord173
ord221
ord218
ord219
msvcrt
fclose
sprintf
exit
__p__iob
fprintf
vsprintf
malloc
free
fflush
atol
_beginthreadex
fopen
strrchr
atoi
_endthreadex
localtime
time
getc
??1type_info@@UAE@XZ
_exit
_sys_errlist
__p__acmdln
__getmainargs
_XcptFilter
??2@YAPAXI@Z
_CxxThrowException
__setusermatherr
_adjust_fdiv
__p__commode
strncpy
realloc
_purecall
calloc
strncmp
__CxxFrameHandler
__set_app_type
??3@YAXPAX@Z
_errno
__p__fmode
_sys_nerr
_initterm
_except_handler3
_controlfp
msvcirt
?endl@@YAAAVostream@@AAV1@@Z
??6ostream@@QAEAAV0@K@Z
??6ostream@@QAEAAV0@PBD@Z
?cout@@3Vostream_withassign@@A
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE