Static task
static1
Behavioral task
behavioral1
Sample
efc7127db3c6f5110c5a7c6b62e26aea58fb2316a9edb66712bbb807146ee266.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
efc7127db3c6f5110c5a7c6b62e26aea58fb2316a9edb66712bbb807146ee266.exe
Resource
win10v2004-20240802-en
General
-
Target
efc7127db3c6f5110c5a7c6b62e26aea58fb2316a9edb66712bbb807146ee266
-
Size
110KB
-
MD5
a9b5a076d6c37a3c94eb193bb5ec735f
-
SHA1
03cf5e79be9a37f8ac515a7a4bc7030dedf74c5d
-
SHA256
efc7127db3c6f5110c5a7c6b62e26aea58fb2316a9edb66712bbb807146ee266
-
SHA512
dd61c9441bf8704fa17ad891f870a3ef10a355d8e199fcf704c89d745e9c37d36b0e8e178c971cc6fe02ae03c68630c8649eff535df90c1fd37a3d22097ef042
-
SSDEEP
1536:FWBGe7RFg+AKv7qaYgrjKJolhv7AvS3+pNesfoVBEzE6qbU65V/I5/:2Lrg+AI7qaDjKJwt7FIeMQ6yU65V/u/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efc7127db3c6f5110c5a7c6b62e26aea58fb2316a9edb66712bbb807146ee266
Files
-
efc7127db3c6f5110c5a7c6b62e26aea58fb2316a9edb66712bbb807146ee266.exe windows:5 windows x64 arch:x64
8af5854e61f4fc1cc4d0956233819592
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wtsapi32
WTSQuerySessionInformationA
WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsA
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
kernel32
GetPrivateProfileIntA
GetCurrentProcess
SizeofResource
LockResource
LoadResource
HeapFree
FindResourceExA
WideCharToMultiByte
WriteConsoleA
SetStdHandle
GetProcessHeap
HeapAlloc
GetStartupInfoA
CreateThread
GetSystemDefaultLangID
GetLastError
Process32Next
ProcessIdToSessionId
Process32First
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
GetPrivateProfileStringA
WaitForSingleObject
TerminateProcess
GetVersionExA
GetModuleFileNameA
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
CloseHandle
ReadFile
GetMailslotInfo
Sleep
CreateMailslotA
OutputDebugStringA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
FindResourceA
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetConsoleMode
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCommandLineA
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
user32
wsprintfA
advapi32
RevertToSelf
LsaAddAccountRights
LsaClose
LookupAccountNameA
LsaOpenPolicy
ImpersonateLoggedOnUser
GetTokenInformation
GetUserNameA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
CloseServiceHandle
StartServiceA
CreateServiceA
OpenSCManagerA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueA
OpenProcessToken
SetServiceStatus
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
shell32
ShellExecuteA
shlwapi
PathFileExistsA
PathRemoveFileSpecA
PathAddBackslashA
Sections
.text Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ