Static task
static1
Behavioral task
behavioral1
Sample
1-sub.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1-sub.exe
Resource
win10v2004-20240802-en
General
-
Target
1-sub.EXE
-
Size
395KB
-
MD5
24108699398b936265e7cf9b1b24c6e7
-
SHA1
f2785473a1a761694db3618a5f424267fc917949
-
SHA256
897e390277f582d5f11910cedfd6c8902d48dfa9494518bd8d0261bd3ede7dfa
-
SHA512
168515ff97bb683eb0e9016eccff77a4aff64a57d555234fe83070f1239dcc68122524950b91d7bf07ceec536dc410c7c2d46ec71f80f6c2c5828366a93ecad1
-
SSDEEP
3072:X0q7pTAD2IR9wQSJw+OPZ4/W02RtjjmHnqE88xjGt/OJLohIG83GTo4/JazLdrKD:Eq7YYQCOVvNlYJEPdT1azLdGfqqlGIl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1-sub.EXE
Files
-
1-sub.EXE.exe windows:5 windows x64 arch:x64
8848feefe0682c100f243fa85ee1da18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForSingleObject
GetWindowsDirectoryW
GetTempPathW
OpenEventW
ExitProcess
lstrcpyW
lstrlenW
GetCurrentProcess
GetSystemDirectoryW
GetModuleFileNameW
LocalFree
CreateProcessW
LocalAlloc
lstrcmpiW
lstrcpyA
CloseHandle
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrlenA
FileTimeToSystemTime
CreateThread
SetEvent
WaitForMultipleObjects
CreateMutexW
OpenMutexW
GetModuleHandleA
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
lstrcmpA
ReadFile
GetFileSize
CreateFileW
CreateEventW
GetTickCount64
GetCurrentProcessId
ReleaseMutex
Sleep
HeapReAlloc
WriteConsoleW
SetStdHandle
LCMapStringW
GetStringTypeW
HeapSize
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
TerminateProcess
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
RaiseException
RtlPcToFileHeader
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
FlushFileBuffers
user32
DispatchMessageW
wsprintfW
DefWindowProcW
RegisterClassW
GetMessageW
TranslateMessage
wsprintfA
DestroyWindow
UnregisterClassW
PostMessageW
CreateWindowExW
ole32
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
Sections
.text Size: 193KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 151KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ