Static task
static1
Behavioral task
behavioral1
Sample
c2848686646bedc692935fe21fead590N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c2848686646bedc692935fe21fead590N.exe
Resource
win10v2004-20240802-en
General
-
Target
c2848686646bedc692935fe21fead590N.exe
-
Size
4.3MB
-
MD5
c2848686646bedc692935fe21fead590
-
SHA1
d675c29a0347a707d5057bfa0d2884bcd91f9cc9
-
SHA256
0aae28d4fe48f9ab9fe5a3e51edc41df5c5be80215dcce2aa455a12deba870c3
-
SHA512
91129056f97b838fb52e3bd9bd5f1b43dc80a41e5c8486ba786d6722495b9adc068b29a616bc594211be653642b627798b1d9e6e1078e8d89c6341d5870bdfa0
-
SSDEEP
24576:lNfyh90/6oTNVph3Qh3OXuNZruEu8CkBLpI1D5+YFM9T6C8oO5DBFa:Hq0TPP6dNZG8Jw1D5+mM9TioIba
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2848686646bedc692935fe21fead590N.exe
Files
-
c2848686646bedc692935fe21fead590N.exe.exe windows:4 windows x86 arch:x86
faea664dccb12d653cbea3ef51eb7d97
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetSystemTime
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
FindNextFileA
FindFirstFileA
FlushFileBuffers
SetStdHandle
FindClose
Sleep
SetFilePointer
LCMapStringW
LCMapStringA
GetStringTypeW
ExitProcess
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
CloseHandle
user32
MessageBoxA
advapi32
GetUserNameW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
Sections
.text Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fQBTvzon Size: 24KB - Virtual size: 20KB
EKxLypzJ Size: 60KB - Virtual size: 58KB
BiNQdyQn Size: 4KB - Virtual size: 987B
aIDDYTEm Size: 264KB - Virtual size: 263KB
zhslhIMV Size: 56KB - Virtual size: 52KB
irIeMsXd Size: 68KB - Virtual size: 64KB
LLLTdZYB Size: 36KB - Virtual size: 34KB
BBAEckFN Size: 32KB - Virtual size: 29KB
eJbVDpbq Size: 44KB - Virtual size: 43KB
xNIGfkWS Size: 336KB - Virtual size: 332KB
vhIBcWte Size: 32KB - Virtual size: 30KB
HBmqTxdX Size: 8KB - Virtual size: 6KB
UGxpspos Size: 64KB - Virtual size: 62KB
aOtOnpqJ Size: 20KB - Virtual size: 17KB
AQSGwurQ Size: 280KB - Virtual size: 278KB
GctqlLnQ Size: 56KB - Virtual size: 52KB
gVRKiqRH Size: 4KB - Virtual size: 340B
CIxWXuwt Size: 444KB - Virtual size: 441KB
oCxyGtiJ Size: 8KB - Virtual size: 5KB
LiONQlXW Size: 276KB - Virtual size: 275KB
MoUwabkn Size: 44KB - Virtual size: 43KB
bjruwaUl Size: 20KB - Virtual size: 16KB
OvtRvIHJ Size: 56KB - Virtual size: 54KB
FSMWXZod Size: 52KB - Virtual size: 50KB
vUYipKtS Size: 64KB - Virtual size: 62KB
fPWuqEsH Size: 32KB - Virtual size: 30KB
tFKPpXoN Size: 48KB - Virtual size: 45KB
ciiVOyAS Size: 28KB - Virtual size: 24KB
nslvsaSD Size: 4KB - Virtual size: 633B
bTzIrcYL Size: 20KB - Virtual size: 18KB
EodGnkDP Size: 16KB - Virtual size: 15KB
rukKSLCF Size: 80KB - Virtual size: 78KB
JthVZudz Size: 60KB - Virtual size: 58KB
sgngrLjv Size: 28KB - Virtual size: 27KB
bjFYFNiv Size: 32KB - Virtual size: 30KB
BjXjYzhN Size: 4KB - Virtual size: 1KB
PNPhnuTE Size: 12KB - Virtual size: 9KB
exFlmyCp Size: 56KB - Virtual size: 54KB
coiqzZhQ Size: 108KB - Virtual size: 107KB
dJYlMqHN Size: 136KB - Virtual size: 134KB
lMHQZTJN Size: 8KB - Virtual size: 6KB
kbOjCRFK Size: 48KB - Virtual size: 44KB
gboHDVRD Size: 32KB - Virtual size: 30KB
BVoSlyVc Size: 36KB - Virtual size: 33KB
CeEIxRrb Size: 64KB - Virtual size: 61KB
mnLLIXpU Size: 4KB - Virtual size: 586B
zCwTcEnj Size: 48KB - Virtual size: 45KB
DOOhFbuw Size: 44KB - Virtual size: 40KB
LStaLUHv Size: 100KB - Virtual size: 97KB
RexJNurr Size: 4KB - Virtual size: 2KB
OMFkhDhq Size: 20KB - Virtual size: 18KB
qqhpCDeR Size: 60KB - Virtual size: 56KB
JkmDqWrm Size: 80KB - Virtual size: 79KB
UYojrnGh Size: 52KB - Virtual size: 49KB
UzUeFfsV Size: 12KB - Virtual size: 10KB
rdwuyCVC Size: 56KB - Virtual size: 55KB
cOSoFbpN Size: 64KB - Virtual size: 60KB
AlwunJRc Size: 88KB - Virtual size: 85KB
LkzddNdd Size: 12KB - Virtual size: 8KB
vGFUJTAF Size: 4KB - Virtual size: 1KB
peekfSUq Size: 76KB - Virtual size: 73KB
fMBLDvYS Size: 4KB - Virtual size: 2KB
JpQfqXPx Size: 56KB - Virtual size: 55KB
DjGTucRS Size: 4KB - Virtual size: 3KB
KhNGufDL Size: 104KB - Virtual size: 101KB
bMKxsSst Size: 24KB - Virtual size: 20KB
iodOkcQq Size: 8KB - Virtual size: 4KB