Static task
static1
Behavioral task
behavioral1
Sample
25dc4d95737c66f10fcb0563ccd247ff6d9a61db6af26ea6471393fd58e17979.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
25dc4d95737c66f10fcb0563ccd247ff6d9a61db6af26ea6471393fd58e17979.exe
Resource
win10v2004-20240802-en
General
-
Target
25dc4d95737c66f10fcb0563ccd247ff6d9a61db6af26ea6471393fd58e17979
-
Size
3.5MB
-
MD5
1c660877d1bbe7305577ee79e5100ce4
-
SHA1
c3c54935410e452cdeef529ddbb9b7a2c66ce2cc
-
SHA256
25dc4d95737c66f10fcb0563ccd247ff6d9a61db6af26ea6471393fd58e17979
-
SHA512
dc3ec26c6fa192b7344625f6b64e10a296eaa28273ac65dcce82306e005dde44fbd9f34ee9ea02f5548270b64d48bb30b941dccc6d0ec9ad118184265af66e8a
-
SSDEEP
98304:4BmS2voPIBI4o+50drK9e0tV+KBaw55YCBKRVona:4BmPv3B1kr+Vg85YYKRana
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25dc4d95737c66f10fcb0563ccd247ff6d9a61db6af26ea6471393fd58e17979
Files
-
25dc4d95737c66f10fcb0563ccd247ff6d9a61db6af26ea6471393fd58e17979.exe windows:5 windows x86 arch:x86
fe92928158e605bd313435e9b44cfb67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbcom
?Close@CDBConnection@@QAEXXZ
libeay32
ord2291
ssleay32
ord8
ws2_32
WSAIoctl
wldap32
ord200
kernel32
GetVersionExA
GetVersionExW
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
MessageBoxW
CharUpperBuffW
gdi32
GetDIBits
comdlg32
GetOpenFileNameW
advapi32
RegDeleteValueW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
Shell_NotifyIconW
gdiplus
GdipTranslateMatrix
shlwapi
PathFileExistsW
winmm
timeSetEvent
comctl32
_TrackMouseEvent
imm32
ImmGetContext
msimg32
AlphaBlend
psapi
GetProcessImageFileNameW
iphlpapi
GetAdaptersInfo
wininet
FindNextUrlCacheEntryW
crypt32
CertFindCertificateInStore
version
VerQueryValueA
urlmon
UrlMkGetSessionOption
netapi32
NetApiBufferFree
ole32
CreateStreamOnHGlobal
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ