Static task
static1
Behavioral task
behavioral1
Sample
3ad09011326f281987ea39772c7fefc0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ad09011326f281987ea39772c7fefc0N.exe
Resource
win10v2004-20240709-en
General
-
Target
3ad09011326f281987ea39772c7fefc0N.exe
-
Size
306KB
-
MD5
3ad09011326f281987ea39772c7fefc0
-
SHA1
5bb6afe856dbf220abb71317898857fd45fc40fc
-
SHA256
e2a5942b7dcbbae77845f8b2b7fc7f0672e0558e5168385ba5f79d03599d83b7
-
SHA512
f956375e7fee0aa7c29cb59f50e582a7eb0a6fa43e5fcf683aef20cdd7ac7977c9b680b562ed43c547ecb83b8c7b903951f5b93e290768b927e6f67c76c8fbb8
-
SSDEEP
6144:XuT7ki4zKwhHICIEqmF9QLDovnqHGyPwUt5Gn4q7siw9sjXvzMudSgG:aoiq92EZTMWnePhE4q40rtdS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ad09011326f281987ea39772c7fefc0N.exe
Files
-
3ad09011326f281987ea39772c7fefc0N.exe.exe windows:4 windows x86 arch:x86
8841a34291cea66ae564784df19e3bf6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WritePrivateProfileSectionW
GetLocaleInfoA
UnhandledExceptionFilter
GetComputerNameA
GetCurrentThread
GetPrivateProfileSectionA
HeapAlloc
VirtualFree
MultiByteToWideChar
HeapSize
SetLastError
EnumResourceTypesA
DeleteFiber
CreateEventA
LCMapStringW
LeaveCriticalSection
RaiseException
GetEnvironmentStringsW
GetFileType
DebugActiveProcess
IsValidLocale
DeleteCriticalSection
GetLastError
EnterCriticalSection
SetStdHandle
GetStartupInfoA
SetHandleCount
GetEnvironmentStrings
GetProcAddress
SetPriorityClass
GetDateFormatA
TlsGetValue
GetConsoleTitleA
CompareStringW
EnumSystemLocalesW
GetStdHandle
VirtualQuery
HeapDestroy
TlsFree
IsBadWritePtr
lstrlen
GetStringTypeW
SetEnvironmentVariableA
GetCommandLineA
HeapReAlloc
HeapCreate
ExitProcess
CreateSemaphoreW
WriteConsoleOutputAttribute
VirtualAlloc
TlsSetValue
QueryPerformanceCounter
GetCurrentProcess
GetTimeZoneInformation
GetModuleHandleA
FreeEnvironmentStringsW
GetSystemInfo
GetTimeFormatA
GetCurrentThreadId
IsValidCodePage
WideCharToMultiByte
CompareStringA
GetACP
GetCurrentProcessId
GetModuleFileNameA
GetUserDefaultLCID
CreateToolhelp32Snapshot
LocalSize
GetTickCount
GetOEMCP
GetProcAddress
FreeEnvironmentStringsA
LCMapStringA
InitializeCriticalSection
RtlUnwind
EnumSystemLocalesA
GetSystemTimeAsFileTime
InterlockedExchange
GetVersionExA
GetSystemDefaultLangID
SetComputerNameW
GetCPInfo
WriteFile
GetLocaleInfoW
GetStringTypeA
HeapFree
TerminateProcess
LoadLibraryA
GetCurrencyFormatA
TlsAlloc
VirtualProtect
gdi32
SetAbortProc
GetBitmapDimensionEx
GetGlyphOutlineA
GetTextExtentPointW
GetPath
GetTextExtentPointA
GetDeviceGammaRamp
PolyPolyline
CreateScalableFontResourceW
SetDIBits
GetKerningPairsW
EnumFontFamiliesW
CreateICW
OffsetViewportOrgEx
GetWinMetaFileBits
RoundRect
SetBoundsRect
PaintRgn
IntersectClipRect
StartPage
ColorCorrectPalette
CreatePalette
shell32
SHGetFileInfo
DragQueryFileA
SHBrowseForFolderA
ExtractIconW
SHUpdateRecycleBinIcon
SHFreeNameMappings
DuplicateIcon
SHGetDataFromIDListA
SHFormatDrive
RealShellExecuteA
DragAcceptFiles
SHGetNewLinkInfo
ShellExecuteW
FreeIconList
CommandLineToArgvW
advapi32
CryptDestroyKey
GetUserNameA
CryptGenRandom
CryptContextAddRef
RegDeleteValueW
RegCreateKeyW
CryptSignHashA
StartServiceW
CryptSetProviderA
CryptEnumProviderTypesW
RegFlushKey
RegReplaceKeyW
RegReplaceKeyA
RegQueryValueW
ReportEventA
RegQueryMultipleValuesA
RegQueryValueExW
CryptDuplicateKey
RegEnumKeyW
RegConnectRegistryW
RevertToSelf
CryptEnumProvidersW
Sections
.text Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ