Static task
static1
Behavioral task
behavioral1
Sample
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe
Resource
win11-20240802-en
General
-
Target
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
-
Size
1.8MB
-
MD5
59c3f3f99f44029de81293b1e7c37ed2
-
SHA1
fb07496900468529719f07ed4b7432ece97a8d3d
-
SHA256
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
-
SHA512
9b3bd8a76d754bf9c899111be986c4fd6d14f6993a9a0e3dcd9b4a76c0f7764ac8798f5cbc7a0467c1562638d85bf52f627bd32c125f587b1e838beaf03c8a0e
-
SSDEEP
49152:aIuQjMgjzus3wLNlDXjUoXFhKoT2iG6xQQqOeaGcWRrLy3pN+:a1bgjyQwhlDFEi5Qt7aGdRrLy5N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471
Files
-
32efb1eb360cda726f0eb7647d1963adf37dada4b1a4b5ec486c88bfa1f21471.exe windows:5 windows x86 arch:x86
fd7200dcd5c0d9d4d277a26d951210aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetFileAttributesW
GetVersionExW
ResumeThread
GetModuleHandleA
CreateEventW
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
SetEvent
TerminateThread
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
GetOverlappedResult
VirtualProtectEx
GetWindowsDirectoryW
GetProcAddress
VirtualAllocEx
LocalFree
GetFileSize
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
CreateProcessA
CreateEventA
ConnectNamedPipe
GetComputerNameA
LocalAlloc
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
GetTempPathW
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindClose
WaitForSingleObject
InitializeCriticalSection
CreatePipe
LeaveCriticalSection
WaitForMultipleObjects
CreateNamedPipeW
GetModuleFileNameW
TerminateProcess
InterlockedDecrement
ReadFile
WriteFile
GetCurrentProcess
GetCommandLineW
EnterCriticalSection
SetHandleInformation
WriteProcessMemory
CancelIo
DecodePointer
SetEndOfFile
HeapSize
WriteConsoleW
FlushFileBuffers
GetStringTypeW
SetStdHandle
ReadConsoleW
SetFilePointerEx
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WideCharToMultiByte
EncodePointer
RaiseException
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleHandleExW
GetACP
HeapReAlloc
GetConsoleCP
GetConsoleMode
FindFirstFileExW
user32
wsprintfW
advapi32
LookupPrivilegeNameW
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptGenRandom
CopySid
IsValidSid
LogonUserA
OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
LookupAccountSidW
GetTokenInformation
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoCreateGuid
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayCreate
iphlpapi
GetIpNetTable
ws2_32
ntohl
WSAStartup
FreeAddrInfoW
htonl
getnameinfo
WSACleanup
GetAddrInfoW
credui
CredUIParseUserNameW
netapi32
NetApiBufferFree
NetGetDCName
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ