Static task
static1
Behavioral task
behavioral1
Sample
7ca19a9a3741e5d272fc70a29501205e3e4f93bc514c1c0b2898189164d705c3.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7ca19a9a3741e5d272fc70a29501205e3e4f93bc514c1c0b2898189164d705c3.exe
Resource
win10v2004-20240802-en
General
-
Target
7ca19a9a3741e5d272fc70a29501205e3e4f93bc514c1c0b2898189164d705c3
-
Size
28KB
-
MD5
883c9ae6cafdd2e4db61e0298eb502e9
-
SHA1
390d5ac96d18d6f12bd15655e9d3b08f94394279
-
SHA256
7ca19a9a3741e5d272fc70a29501205e3e4f93bc514c1c0b2898189164d705c3
-
SHA512
ffb9441cfe54273bec245893622ddecc5860cd5ce3793cd44b487131c041f9780640c079200521e3692702803a98af7f4d71fb5ac7cf5c20fcd6e3d3a99c0259
-
SSDEEP
768:snq4Y9nJi7G4AoEHzRugcto6OFpiJvcwB:v4Y9nJwG4AFVMVO8vcw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ca19a9a3741e5d272fc70a29501205e3e4f93bc514c1c0b2898189164d705c3
Files
-
7ca19a9a3741e5d272fc70a29501205e3e4f93bc514c1c0b2898189164d705c3.exe windows:5 windows x86 arch:x86
1609a9ccb239782a87ab190f2955f879
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90
ord316
ord300
ord817
ord820
ord5963
ord305
ord3213
ord5750
ord6791
ord5761
ord6802
ord1252
ord9252
ord7118
ord7312
ord8432
ord9945
ord7746
ord12597
ord12145
ord13116
ord10284
ord10437
ord9952
ord13174
ord12384
ord1258
ord5646
ord5663
ord4333
ord5657
ord3209
ord2087
ord3579
ord266
ord1254
ord1247
ord4199
ord5813
ord6721
ord5533
ord1046
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord4159
ord6783
ord4952
ord6001
ord4981
ord5659
ord4409
ord4029
ord4434
ord265
ord4667
ord4890
ord4334
ord2886
ord1137
ord5924
ord4057
ord4067
ord4066
ord2759
ord2888
ord2769
ord3110
ord1611
ord1276
ord2961
ord4714
ord3107
ord2978
ord2766
ord2539
ord310
ord601
ord800
msvcr90
_access
_stricmp
_setmbcp
memset
_CxxThrowException
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__argc
_time64
fclose
_localtime64
fwrite
memcpy_s
fread
fopen
atoi
_localtime64_s
malloc
__argv
vsprintf
sprintf
__CxxFrameHandler3
kernel32
Sleep
GetFileAttributesExA
GetCurrentProcess
HeapFree
GetProcessHeap
WideCharToMultiByte
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
DeleteFileA
CloseHandle
GetModuleFileNameA
CopyFileA
UnmapViewOfFile
advapi32
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyA
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExA
shlwapi
StrStrIA
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
SysStringByteLen
SafeArrayGetElement
VariantChangeType
VariantInit
VariantCopy
VariantClear
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ