Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240709-en
General
-
Target
1.exe
-
Size
5.5MB
-
MD5
ea7b9413c72c9d98c8ccfac74711e7b7
-
SHA1
c6d8ff216ec6f12b71311221fd40f23fd886c9d8
-
SHA256
262f17802a4eaaf53f79f040ecb60575f7aa85c50ba6a4fc1663229c38d91c36
-
SHA512
418b40101582b90b23e22ae60a48886d33a42e8ef4aaf09f9f9226d12a70538f1b4f27aff1efbb12397b8011fb83d2437bda39f8e1be8855d9fcbc213c20eb1d
-
SSDEEP
98304:ZC1QdJrE/dYuv/qTmCQ2yGBZn+UT03SoYpTu5IiAIIvv3Qjd:ZChYu3YmOZZn+UT0Co0ehcv3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.exe
Files
-
1.exe.exe windows:6 windows x64 arch:x64
dcba1dab8fe9a041d8aab11bd133ef00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileA
CloseHandle
GetLastError
GetCurrentDirectoryA
ConvertThreadToFiber
SwitchToFiber
GetModuleFileNameA
GetModuleHandleA
GetCurrentProcessId
GetFileInformationByHandle
SetFileAttributesA
CreateFileMappingA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
CreateNamedPipeA
WaitNamedPipeA
ExitProcess
VirtualAlloc
SetNamedPipeHandleState
Sections
.text Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rodata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ