Static task
static1
Behavioral task
behavioral1
Sample
exbymploader.exe
Resource
win11-20240802-en
General
-
Target
exbymploader.exe
-
Size
237KB
-
MD5
2335de8c7359894f309c2d09a6f91ac1
-
SHA1
93ff80a17c118a3519119b393c8135176f8221cf
-
SHA256
7cb940a43232107f95550b67d10b2ecb612d28f8be3d29d3c3418a33e80e253c
-
SHA512
78ea91cfae7988d83a9de042070671a42f5b74006807e0fc23a9dec96a984a428c917f2cd80823ab7077972bd504911c537e3358b3ebf93934128d716e11c431
-
SSDEEP
6144:hw5aACVv9U5f8KvImfDG55J9jVkvdkBobN/p5/9RwJ:hwxeK5kKvXq5tBWdOoRlR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource exbymploader.exe
Files
-
exbymploader.exe.exe windows:1 windows x86 arch:x86
140094f13383e9ae168c4b35b6af3356
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
ExitProcess
GetComputerNameA
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
SetErrorMode
Sleep
VirtualAllocExNuma
shlwapi
PathFindFileNameA
msvcrt
malloc
free
memset
strcmp
_strcmpi
strcpy
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ