Static task
static1
Behavioral task
behavioral1
Sample
d2ea3ae775245c2f59d2c01af9d580f0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d2ea3ae775245c2f59d2c01af9d580f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
d2ea3ae775245c2f59d2c01af9d580f0N.exe
-
Size
4.3MB
-
MD5
d2ea3ae775245c2f59d2c01af9d580f0
-
SHA1
afb3c52ae92a242869af111b2069ff61c1ced9be
-
SHA256
22c8be182914cd4d6870593d0a59124d500ab8a75326e496a27a29664fbebffb
-
SHA512
44b8750b67e57fc8eab6d7d075b4e95abbf169e045e830ae2c1ac1ac1a5f50fe507a8d2b267b15ea40138dfc69c7dd24bd3b1dba9c93ff57407a6744022fa95a
-
SSDEEP
98304:LbujbkZoE/9MRLsBa2XKwEUJ8GHtT7dJrfbvFMqMIO:LbunU1YojXoUJ8qrDiqu
Malware Config
Signatures
Files
-
d2ea3ae775245c2f59d2c01af9d580f0N.exe.exe windows:5 windows x86 arch:x86
743d5e3ef77cdeb459cdc4beffed62d7
Code Sign
fb:d4:9a:85:70:89:69:48:42:03:fe:97:ef:3c:2b:5dCertificate
IssuerPOSTALCODE=10051Not Before13-07-2021 22:27Not After13-07-2022 22:27SubjectPOSTALCODE=10051ef:81:23:09:7c:73:fb:54:91:5d:31:c8:13:9b:ff:a7:29:32:33:b1:f9:e0:d9:01:cc:5e:31:dc:54:68:a0:2fSigner
Actual PE Digestef:81:23:09:7c:73:fb:54:91:5d:31:c8:13:9b:ff:a7:29:32:33:b1:f9:e0:d9:01:cc:5e:31:dc:54:68:a0:2fDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\dexuvod\midore_nokurikoyutu\nopon18 zap-liri-disuv_novomegoguci.pdb
Imports
kernel32
ReadConsoleInputA
SetTapeParameters
SetTapePosition
WriteTapemark
GetConsoleAliasesA
WriteConsoleW
SetLastError
CreateFileA
DeleteFileA
WritePrivateProfileSectionA
GetPrivateProfileSectionW
WriteProfileSectionW
RequestDeviceWakeup
LoadLibraryW
FlushFileBuffers
GetLongPathNameA
ReadFile
WriteFile
GetProfileSectionA
BuildCommDCBA
FindActCtxSectionGuid
SetEndOfFile
SetFileShortNameA
WriteProcessMemory
WriteConsoleInputA
SetEvent
PulseEvent
ResetEvent
ReleaseSemaphore
SleepEx
WaitForSingleObject
WaitForMultipleObjects
AllocConsole
ReadConsoleW
ReleaseActCtx
GetProcessHeap
BuildCommDCBAndTimeoutsW
GetGeoInfoW
VirtualProtect
GetProcAddress
GetModuleHandleW
HeapUnlock
GetOEMCP
WaitForMultipleObjectsEx
SetSystemPowerState
FindAtomW
CreateJobObjectW
HeapValidate
GetDiskFreeSpaceA
GetCPInfoExW
ZombifyActCtx
GetUserDefaultLCID
GetFileAttributesA
GetConsoleAliasesLengthA
GetCommandLineA
GetStartupInfoA
GetLastError
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
GetConsoleCP
GetConsoleMode
RtlUnwind
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
IsValidCodePage
MultiByteToWideChar
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CloseHandle
advapi32
AdjustTokenPrivileges
MapGenericMask
AreAnyAccessesGranted
AdjustTokenGroups
winhttp
WinHttpSetOption
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ