Static task
static1
Behavioral task
behavioral1
Sample
5948b524b2403d79c9ccb83a0585d850N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5948b524b2403d79c9ccb83a0585d850N.exe
Resource
win10v2004-20240709-en
General
-
Target
5948b524b2403d79c9ccb83a0585d850N.exe
-
Size
32KB
-
MD5
5948b524b2403d79c9ccb83a0585d850
-
SHA1
6188463558a2f8609c2279820069af8bc78984a1
-
SHA256
8a9f95dc52ab28399e3a798126872437d6127f14a639549a03d8967fe0721895
-
SHA512
0f4bae4e6790ddff37043cfb2f89dcac9f0237dca8e6d0d3fd803213a2daa91e97ac2cf7a693a0dc03fb7a896e652e58a304dd1a72201bcf813873ee2f0beca6
-
SSDEEP
192:GAGqjRFGKMh9ED/IDExeorm9+Dfp0GjW5sH2t3AIa6abHa5tGbFOvhp:PVR8iQLoFx1jW5sIZR5tGwvn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5948b524b2403d79c9ccb83a0585d850N.exe
Files
-
5948b524b2403d79c9ccb83a0585d850N.exe.exe windows:5 windows x86 arch:x86
6e422d9571eebc39b9447b608be77f42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrToIntA
StrStrA
StrChrA
ws2_32
htons
setsockopt
WSAIoctl
recv
WSAGetLastError
closesocket
gethostbyname
send
connect
WSAStartup
socket
gethostname
WSACleanup
wininet
DeleteUrlCacheEntry
advapi32
GetUserNameA
RegOpenKeyExA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
urlmon
URLOpenBlockingStreamA
kernel32
CreateMutexA
GetModuleFileNameA
CreatePipe
OpenMutexA
CloseHandle
GetLastError
GetVersionExA
CreateDirectoryA
lstrcatA
ReadFile
TerminateProcess
GetTempPathA
lstrcpyA
SetCurrentDirectoryA
WinExec
GetLocalTime
HeapAlloc
CreateProcessA
GetExitCodeProcess
ExitProcess
GetComputerNameA
CreateFileA
GetFileSize
lstrcmpA
lstrlenA
IsProcessorFeaturePresent
HeapFree
WaitForSingleObject
GetTickCount
GetProcessHeap
WriteFile
GetCommandLineA
GlobalAlloc
Sleep
shell32
ShellExecuteA
user32
wsprintfA
iphlpapi
GetAdaptersInfo
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ