DllGetVersion
Static task
static1
Behavioral task
behavioral1
Sample
ed9c1342ee368447bee14d76120872551ae2c950f827bf5f9279d02d7be41a8f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ed9c1342ee368447bee14d76120872551ae2c950f827bf5f9279d02d7be41a8f.exe
Resource
win10v2004-20240730-en
General
-
Target
ed9c1342ee368447bee14d76120872551ae2c950f827bf5f9279d02d7be41a8f.exe
-
Size
11.0MB
-
MD5
7f6f2a783af7c12b9b5c55d39fd70ba0
-
SHA1
d3ebba04bba6cc55e6cdf971a313bd6ac469c477
-
SHA256
ed9c1342ee368447bee14d76120872551ae2c950f827bf5f9279d02d7be41a8f
-
SHA512
6286ec6a274e2e8ef8eda29e8d562032c914559064cfd0ef09cd9c8ec59108c5df5940be4f88b2eff0030911ca3056ae01906076faf53dfe37d3ad675f58251f
-
SSDEEP
3072:3whlNR5hRSR20Yd6mTkt7t0ZmTaTJSYvd+mT2VFxRdqwvl6nDtGp7A3sCG9MDVkn:AT5Hd6mTc64TeJS+dOzqOlgt3sCLGp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed9c1342ee368447bee14d76120872551ae2c950f827bf5f9279d02d7be41a8f.exe
Files
-
ed9c1342ee368447bee14d76120872551ae2c950f827bf5f9279d02d7be41a8f.exe.exe windows:5 windows x64 arch:x64
d9559bfb40feeb2830a21f803e8df96c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetUserDefaultUILanguage
ExpandEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateProcess
GetLastError
GetModuleHandleExW
IsWow64Process
FlushFileBuffers
SetStdHandle
CreateFileW
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
DeactivateActCtx
ReleaseActCtx
LCMapStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetModuleFileNameA
GetFileType
GetStdHandle
GetProcessHeap
GetModuleHandleW
GetStartupInfoW
TlsFree
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
SetLastError
GetCPInfo
GetOEMCP
HeapReAlloc
ActivateActCtx
CreateActCtxW
GetFileAttributesW
CreateProcessW
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetCurrentProcess
FreeLibrary
GetModuleFileNameW
LoadLibraryW
CreateMutexW
CloseHandle
Sleep
WaitForSingleObject
ReleaseMutex
GetProcAddress
WriteConsoleW
LoadLibraryExW
GetACP
IsValidCodePage
HeapSize
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
HeapAlloc
HeapFree
GetCommandLineA
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
VirtualAlloc
user32
DispatchMessageW
GetMessageW
wsprintfW
TranslateMessage
PostMessageW
LoadStringW
GetWindowThreadProcessId
GetDesktopWindow
GetWindowRect
SetWindowTextW
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
IsDlgButtonChecked
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos
AttachThreadInput
SendMessageW
FindWindowW
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
gdi32
GetDeviceCaps
advapi32
RegCreateKeyW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyW
RegCloseKey
ole32
CLSIDFromProgID
CoCreateInstance
CoInitialize
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Exports
Exports
Sections
.text Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10.8MB - Virtual size: 10.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ