Static task
static1
Behavioral task
behavioral1
Sample
a01ac4244102e3958296c70d71e3d951f11abcc355458d1918d081587b151d90.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a01ac4244102e3958296c70d71e3d951f11abcc355458d1918d081587b151d90.exe
Resource
win10v2004-20240729-en
General
-
Target
a01ac4244102e3958296c70d71e3d951f11abcc355458d1918d081587b151d90.exe
-
Size
1.3MB
-
MD5
c7ea74a05e864d4d67a2fba6be3bb667
-
SHA1
be91a12de06e01a7e10b1dd514dbedb699f180e4
-
SHA256
a01ac4244102e3958296c70d71e3d951f11abcc355458d1918d081587b151d90
-
SHA512
ad03970be59ae08deaf69ffe3078704f9471a76789c040d695a21ab4ffd95377137ab64f19e33f6d9a9fa1b4ec11bd1c66b4a5bbc55dc413cd79aa6376b6a713
-
SSDEEP
24576:fWljizSawkL2zmeaAit8v1hUw+hqPNKLkFh:+l2akSz+AitK5EAF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a01ac4244102e3958296c70d71e3d951f11abcc355458d1918d081587b151d90.exe
Files
-
a01ac4244102e3958296c70d71e3d951f11abcc355458d1918d081587b151d90.exe.exe windows:6 windows x64 arch:x64
b1586d63a786074f33bd0544b4df7b1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapCreate
GetProcAddress
GetModuleHandleA
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapFree
HeapAlloc
GetModuleHandleExW
TerminateProcess
ExitProcess
GetCurrentProcess
GetModuleFileNameW
WriteFile
GetStdHandle
RtlPcToFileHeader
RaiseException
EncodePointer
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
comdlg32
PageSetupDlgA
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA
FindTextA
ReplaceTextA
ChooseFontA
PrintDlgA
PrintDlgExA
CommDlgExtendedError
advapi32
GetUserNameA
DecryptFileA
ole32
OleGetAutoConvert
OleDoAutoConvert
OleRegGetUserType
OleGetIconOfFile
IsAccelerator
GetClassFile
MonikerCommonPrefixWith
MonikerRelativePathTo
MkParseDisplayName
CoInstall
CoTreatAsClass
CoDosDateTimeToFileTime
CoIsOle1Class
CoAllowSetForegroundWindow
CoGetInstanceFromFile
CoRevokeInitializeSpy
CoRevokeMallocSpy
CLSIDFromProgIDEx
CoFileTimeNow
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInvalidateRemoteMachineBindings
CoGetTreatAsClass
CoWaitForMultipleHandles
StringFromGUID2
CLSIDFromProgID
ProgIDFromCLSID
IIDFromString
StringFromIID
CoGetInterceptor
StringFromCLSID
CoDisableCallCancellation
CoEnableCallCancellation
CoTestCancel
CoCancelCall
CoGetCancelObject
CoSwitchCallContext
CoQueryAuthenticationServices
CoRevertToSelf
CoImpersonateClient
CoCopyProxy
CoSetProxyBlanket
CoQueryProxyBlanket
CoGetCallContext
CoGetInterfaceAndReleaseStream
CoGetStdMarshalEx
CoLockObjectExternal
CoDisconnectObject
CoUnmarshalHresult
CoMarshalHresult
CoMarshalInterface
CoGetMarshalSizeMax
CoSuspendClassObjects
CoResumeClassObjects
CoGetClassObject
CoGetObjectContext
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCallerTID
CoUninitialize
CoGetMalloc
CLSIDFromString
dxgi
CreateDXGIFactory
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ