Static task
static1
Behavioral task
behavioral1
Sample
961249afb5204a277967c7961e17d81896aefba3b5ed8aa1398d23dc18a8943f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
961249afb5204a277967c7961e17d81896aefba3b5ed8aa1398d23dc18a8943f.exe
Resource
win10v2004-20240802-en
General
-
Target
961249afb5204a277967c7961e17d81896aefba3b5ed8aa1398d23dc18a8943f
-
Size
7.6MB
-
MD5
cf5a04a17e91794b89a4c04e52a4260d
-
SHA1
47c92ad9314ea4d19ac1c9f24f8c6c86f28e0be1
-
SHA256
961249afb5204a277967c7961e17d81896aefba3b5ed8aa1398d23dc18a8943f
-
SHA512
8daf15cd62b7cf528cf5b91d991c3798e550f8d30818f88bceabd8668edb70c323bbe3b9b6e324e0322db9abdd226ddf272b9d9b25dce02036d50aaff11e6201
-
SSDEEP
49152:oNXJOtxewN4BPQVidLqoO/cqTKSKu3gUoAmrwpZVQijDKOdlW8r3uh+qp4aAm7uB:wmYXopKuKQYeman+PuNyR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 961249afb5204a277967c7961e17d81896aefba3b5ed8aa1398d23dc18a8943f
Files
-
961249afb5204a277967c7961e17d81896aefba3b5ed8aa1398d23dc18a8943f.exe windows:6 windows x64 arch:x64
461fd138b4bf9fba51933527f80e1877
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
GetProcAddress
WaitForSingleObject
SleepConditionVariableSRW
SetConsoleCtrlHandler
HeapSize
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
SetHandleInformation
TryAcquireSRWLockExclusive
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CloseHandle
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
LeaveCriticalSection
SetFileCompletionNotificationModes
EnterCriticalSection
EncodePointer
WriteFile
RtlVirtualUnwind
LoadLibraryA
FreeLibrary
GetCurrentProcess
GetStdHandle
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
CreateMutexA
WaitForSingleObjectEx
lstrlenW
ReleaseMutex
GetModuleHandleA
SetFileInformationByHandle
GetProcessHeap
HeapAlloc
HeapFree
GetConsoleCP
GetCommandLineW
GetFullPathNameW
FindNextFileW
FindClose
CreateFileW
FlushFileBuffers
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFilePointerEx
GetFinalPathNameByHandleW
GetConsoleMode
GetFileType
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
FormatMessageW
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetStartupInfoW
ExitProcess
TerminateProcess
MultiByteToWideChar
WriteConsoleW
SetLastError
WideCharToMultiByte
CreateThread
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetThreadStackGuarantee
AddVectoredExceptionHandler
WakeConditionVariable
WakeAllConditionVariable
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
ReleaseSRWLockExclusive
HeapReAlloc
InitializeSListHead
GetCurrentThreadId
AcquireSRWLockExclusive
user32
GetProcessWindowStation
GetUserObjectInformationA
advapi32
RegCloseKey
RegEnumKeyA
RegOpenKeyA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
SetServiceStatus
SystemFunction036
RegSetKeyValueA
RegGetValueA
iphlpapi
CreateUnicastIpAddressEntry
InitializeUnicastIpAddressEntry
DeleteUnicastIpAddressEntry
GetUnicastIpAddressTable
ws2_32
socket
WSAGetLastError
closesocket
getaddrinfo
WSAStartup
WSACleanup
ioctlsocket
setsockopt
getsockopt
WSASend
send
recv
shutdown
getsockname
accept
listen
connect
bind
WSASocketW
freeaddrinfo
WSAIoctl
ntdll
NtCancelIoFileEx
RtlNtStatusToDosError
NtWriteFile
NtReadFile
NtDeviceIoControlFile
NtCreateFile
bcrypt
BCryptGenRandom
Sections
.text Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 502KB - Virtual size: 502KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ