Static task
static1
Behavioral task
behavioral1
Sample
c1a927497ab4ee2b67b2a7029f4cc7d0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c1a927497ab4ee2b67b2a7029f4cc7d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
c1a927497ab4ee2b67b2a7029f4cc7d0N.exe
-
Size
3.9MB
-
MD5
c1a927497ab4ee2b67b2a7029f4cc7d0
-
SHA1
b6e77520de89f978435d4378954626faac5b1e2e
-
SHA256
ae162606ed93cc0a702fffedc6b44e1d5568ce2b6c963fc1afd93353ec63a7f9
-
SHA512
6897485b754d38027f1a7e8049abed118159fbf4734a5b8f3bebf436997e623124b2f3c7ff9d8607cb0272dcee673bcf98c797ff1e5598952b9c102deaed1317
-
SSDEEP
98304:BCAYQ2tEF71OKKWdnrtx7RJfAQvP/YvcIzw1UZqRdz:oAt2E71SWJtlAQvP/Ndz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1a927497ab4ee2b67b2a7029f4cc7d0N.exe
Files
-
c1a927497ab4ee2b67b2a7029f4cc7d0N.exe.exe windows:5 windows x86 arch:x86
91ef4336af36c4f376ab4d6c54609738
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW
kernel32
GetEnvironmentStringsW
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessTimes
GetProcessWorkingSetSize
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathW
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
IsDBCSLeadByteEx
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
lstrlenW
MapViewOfFile
MoveFileExW
GetDriveTypeW
MultiByteToWideChar
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadConsoleW
ReadFile
ReleaseMutex
LCMapStringA
RemoveDirectoryW
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleMode
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesW
SetFileTime
SetLastError
SetProcessPriorityBoost
SetStdHandle
SetUnhandledExceptionFilter
SleepEx
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetHandleCount
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RtlUnwind
GetDiskFreeSpaceExW
GetDateFormatW
GetDateFormatA
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetCurrencyFormatW
GetCPInfo
GetConsoleMode
GetConsoleCP
GetComputerNameW
GetACP
FreeLibrary
FreeEnvironmentStringsW
FormatMessageW
FormatMessageA
FoldStringW
FlushFileBuffers
FlushConsoleInputBuffer
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
ExitThread
ExitProcess
EnumSystemLocalesW
EnumSystemLocalesA
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteFileA
DeleteCriticalSection
CreateThread
CreateSemaphoreW
CreateProcessW
CreateMutexW
CreateMutexA
CreateIoCompletionPort
CreateFileW
CreateFileMappingW
CreateEventW
CreateEventA
CreateDirectoryW
CompareStringW
CreateProcessA
InitializeCriticalSection
EnterCriticalSection
GetTickCount
LeaveCriticalSection
LoadLibraryA
RaiseException
GetCommandLineA
GetVersion
GetThreadLocale
GetCurrentThreadId
VirtualAlloc
GetStringTypeA
MoveFileW
ReleaseSemaphore
user32
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
MessageBoxA
GetKeyboardType
wsprintfW
wsprintfA
rpcrt4
UuidToStringW
RpcStringFreeW
advapi32
StartServiceW
SetServiceStatus
RevertToSelf
ReportEventW
ReportEventA
RegSetValueExW
RegSetValueExA
RegSaveKeyA
RegRestoreKeyA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegisterServiceCtrlHandlerW
RegisterEventSourceW
RegisterEventSourceA
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
QueryServiceStatus
QueryServiceLockStatusW
QueryServiceConfigW
OpenThreadToken
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupPrivilegeValueW
LookupPrivilegeValueA
LookupAccountSidW
LookupAccountNameW
LogonUserW
LockServiceDatabase
IsValidSecurityDescriptor
ImpersonateLoggedOnUser
GetTokenInformation
GetSidSubAuthorityCount
GetSidLengthRequired
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetKernelObjectSecurity
GetAclInformation
EnumServicesStatusW
DestroyPrivateObjectSecurity
DeregisterEventSource
DeleteService
CreateServiceW
CopySid
ControlService
CloseServiceHandle
ChangeServiceConfigW
AllocateLocallyUniqueId
UnlockServiceDatabase
StartServiceCtrlDispatcherA
ole32
CoCreateInstance
CoTaskMemFree
CoUninitialize
StringFromCLSID
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 380KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_vga_3 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE