Static task
static1
Behavioral task
behavioral1
Sample
727ab9d0461350b398d8643e4d35cf30N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
727ab9d0461350b398d8643e4d35cf30N.exe
Resource
win10v2004-20240802-en
General
-
Target
727ab9d0461350b398d8643e4d35cf30N.exe
-
Size
399KB
-
MD5
727ab9d0461350b398d8643e4d35cf30
-
SHA1
9ce71256af57f28cf7bdec9b0065a4715c64f5eb
-
SHA256
87eb0bb80ede226a61c98c8301bd809834196268885c0b3e214512b562a6a923
-
SHA512
b7d7cb6605e3d7fbd47463739f8fe284a97320922bd4051effe0143994d92b734215afaa26a1125a3c4306b9222324718684415bbe1c9d1c1ea10fc8218ee55c
-
SSDEEP
12288:wymJN+pCYT+YBY/2YsWCIlqIO0fetOXRvz+:Nmyp7THVY7lC8K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 727ab9d0461350b398d8643e4d35cf30N.exe
Files
-
727ab9d0461350b398d8643e4d35cf30N.exe.exe windows:6 windows x86 arch:x86
086b5534303e2b325880f187f0010658
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileW
GetLastError
FindNextFileW
FindClose
MoveFileExW
CloseHandle
AddVectoredExceptionHandler
SetThreadStackGuarantee
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
GetCommandLineW
GetProcessId
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
GetTimeZoneInformationForYear
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
SetFilePointerEx
MultiByteToWideChar
WriteConsoleW
SetLastError
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
CreateMutexA
RtlCaptureContext
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
CreateDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
ReadFileEx
SleepEx
WriteFileEx
GetSystemTimeAsFileTime
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
SystemTimeToFileTime
GetConsoleOutputCP
FlushFileBuffers
HeapSize
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
DecodePointer
user32
AllowSetForegroundWindow
ntdll
NtReadFile
RtlNtStatusToDosError
NtWriteFile
Sections
.text Size: 284KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ