Static task
static1
Behavioral task
behavioral1
Sample
9e8e170414cbc2ceb8d0da0deea204e0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9e8e170414cbc2ceb8d0da0deea204e0N.exe
Resource
win10v2004-20240704-en
General
-
Target
9e8e170414cbc2ceb8d0da0deea204e0N.exe
-
Size
450KB
-
MD5
9e8e170414cbc2ceb8d0da0deea204e0
-
SHA1
919494f08e719f7d17506bd309103211149a42c0
-
SHA256
0dedc68479fa365abd3b19f1b96f1a4b99dfe2ff33cd64cc661c0109e6d3fdbb
-
SHA512
c1e481340204fd148df3b99631e4f8d0e082b01a93dd0aef81b494c04467e02a6eeb0e38431cfc8b1a63460bc4fd0260f3d6e9e7ac870fdb348dcfb953420b85
-
SSDEEP
12288:J8Xeb0s4CDbeEsE2EGwwIp8yjF2qWZXQzTiJknEnCrvT1JWt:J8XG0UsElGXsjBWZSTiOnECnM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e8e170414cbc2ceb8d0da0deea204e0N.exe
Files
-
9e8e170414cbc2ceb8d0da0deea204e0N.exe.exe windows:6 windows x86 arch:x86
9707aa07d1d84b79c42a82bf42723010
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
Sleep
ExitProcess
CreateThread
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
VirtualProtectEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
ReadProcessMemory
ContinueDebugEvent
WaitForDebugEvent
DebugActiveProcessStop
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
CreateProcessA
GetModuleFileNameA
DebugSetProcessKillOnExit
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualProtect
IsDebuggerPresent
GetCurrentProcess
OpenProcess
VirtualAllocEx
LoadLibraryA
lstrlenA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeSListHead
msvcp140
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
_Mbrtowc
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
_except_handler4_common
_purecall
memset
memmove
__CxxFrameHandler3
_CxxThrowException
__std_exception_copy
__std_terminate
__std_type_info_destroy_list
__std_exception_destroy
memcpy
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_seh_filter_exe
_get_narrow_winmain_command_line
_initterm
_cexit
_register_onexit_function
_exit
_crt_at_quick_exit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_initialize_onexit_table
_initterm_e
_initialize_narrow_environment
terminate
_controlfp_s
_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
exit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 41KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxx Size: 389KB - Virtual size: 392KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE