Static task
static1
Behavioral task
behavioral1
Sample
cde7213ef0d1a7c0941ab096c87c4a310792673fdf282839e8c1895881199811.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cde7213ef0d1a7c0941ab096c87c4a310792673fdf282839e8c1895881199811.exe
Resource
win10v2004-20240802-en
General
-
Target
cde7213ef0d1a7c0941ab096c87c4a310792673fdf282839e8c1895881199811
-
Size
405KB
-
MD5
89159ccf7b75a3a5c4fc04db4342451f
-
SHA1
69d5852f94136dcbf96630ed06cd550535e47086
-
SHA256
cde7213ef0d1a7c0941ab096c87c4a310792673fdf282839e8c1895881199811
-
SHA512
b1adfd630ffa70bcda690ab3282b99aa75462637fdb1a3c905ffae24ea26c787e2233ffd68331746b48066d95ca2f9f9ed0b1cc6aa8531106d893902794844c1
-
SSDEEP
6144:QgFkEmjRL6p2bFs/STrz5JmwQhplkU/9kzcc3itlFX6gxc:QgFNmjRe2R/5Jm5zl9kzSt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cde7213ef0d1a7c0941ab096c87c4a310792673fdf282839e8c1895881199811
Files
-
cde7213ef0d1a7c0941ab096c87c4a310792673fdf282839e8c1895881199811.exe windows:5 windows x86 arch:x86
e753b0928846f1fb38f0852b26d2615a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetTickCount
FormatMessageW
CreateProcessW
GetCommandLineA
GetCommandLineW
SetEnvironmentVariableA
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
GetWindowsDirectoryA
GetWindowsDirectoryW
GetVersionExW
IsValidCodePage
GetACP
GetOEMCP
MultiByteToWideChar
WideCharToMultiByte
GetThreadLocale
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LocalAlloc
GetCurrentThreadId
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointerEx
SetStdHandle
GetCPInfo
FindNextFileA
FindFirstFileExA
LCMapStringW
GetFileAttributesExW
GetConsoleCP
GetStringTypeW
HeapReAlloc
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
InterlockedPushEntrySList
OutputDebugStringW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeSListHead
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetExitCodeProcess
TerminateProcess
ExitProcess
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapSize
LocalFree
SetLastError
MoveFileW
FindNextFileW
FindFirstFileW
DeleteFileW
GetFileAttributesW
SetFileAttributesW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTempFileNameW
GetDriveTypeA
UnmapViewOfFile
CloseHandle
FindClose
SetFilePointer
SetEndOfFile
FlushFileBuffers
ReadFile
GetFileInformationByHandle
UnlockFile
GetShortPathNameW
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
GetProcAddress
FreeLibrary
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetLocalTime
CompareStringW
WriteConsoleW
WriteConsoleA
FlushConsoleInputBuffer
GetConsoleScreenBufferInfo
GetNumberOfConsoleInputEvents
GetConsoleMode
ReadConsoleInputW
WriteFile
GetStdHandle
Sleep
user32
MessageBoxA
gdi32
DeleteObject
advapi32
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegDeleteValueA
RegCreateKeyExW
RegCloseKey
shell32
SHFileOperationW
shlwapi
PathCanonicalizeW
Sections
.text Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ