Static task
static1
Behavioral task
behavioral1
Sample
a2a67ec1404b2fe5decf5ea86de316f8a2ca775480deab3eed28b8b0b2c34ab5.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a2a67ec1404b2fe5decf5ea86de316f8a2ca775480deab3eed28b8b0b2c34ab5.exe
Resource
win10v2004-20240704-en
General
-
Target
a2a67ec1404b2fe5decf5ea86de316f8a2ca775480deab3eed28b8b0b2c34ab5.exe
-
Size
3.7MB
-
MD5
2a120279c3a167d9210b7ef109a040ce
-
SHA1
c92f6d9afac3bb253a9858db6f53c33241d715ad
-
SHA256
a2a67ec1404b2fe5decf5ea86de316f8a2ca775480deab3eed28b8b0b2c34ab5
-
SHA512
128165f56af2f36aaf2876d905c145d4b990a2a926bdc84a3516d421a991aa0dbdaa7a284934605b3bbc77dc2ece5afe23fd194cf53f448fc95cf692a2db2dc6
-
SSDEEP
49152:LkXEVk8yAvoGApclDX+JeoxKtMHYDP8i66zBAA/uNe6CIkb:uuAClLVh84zqNe6CIu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2a67ec1404b2fe5decf5ea86de316f8a2ca775480deab3eed28b8b0b2c34ab5.exe
Files
-
a2a67ec1404b2fe5decf5ea86de316f8a2ca775480deab3eed28b8b0b2c34ab5.exe.exe windows:6 windows x64 arch:x64
fc8f46511d3a95f43d1a9cb5298ce8a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeviceIoControl
VirtualAlloc
InitializeCriticalSectionEx
GetModuleHandleA
HeapSize
GetTempPathA
GetLastError
CreateFileA
HeapReAlloc
CloseHandle
HeapAlloc
DecodePointer
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SetConsoleTitleA
GetCurrentProcess
VirtualFree
LoadLibraryExA
MultiByteToWideChar
Sleep
LoadLibraryW
FreeLibrary
GetCurrentThreadId
SetUnhandledExceptionFilter
SetEndOfFile
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
HeapFree
GetProcAddress
AddVectoredExceptionHandler
LoadLibraryA
TerminateProcess
RemoveVectoredExceptionHandler
IsValidCodePage
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
FormatMessageA
GetStringTypeW
WideCharToMultiByte
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
LocalFree
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RaiseException
RtlUnwindEx
RtlPcToFileHeader
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DeleteFileW
ReadFile
ReadConsoleW
RtlUnwind
user32
FindWindowA
UnhookWindowsHookEx
SetWindowsHookExA
PostThreadMessageA
GetWindowThreadProcessId
advapi32
RegCloseKey
RegOpenKeyA
RegDeleteKeyA
RegSetKeyValueA
RegCreateKeyA
ntdll
RtlInitUnicodeString
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQuerySystemInformation
Sections
.text Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ