Static task
static1
Behavioral task
behavioral1
Sample
53237c2782ec5dbdabb8350a3ef5e8c25662436052e92ae1300f3f41be984ea6.exe
Resource
win7-20240729-en
General
-
Target
7dd2d4136ddf4fa8a9b7822929ba5f9c819911e254e3187abdb098bf3c144600
-
Size
203KB
-
MD5
e14479a1697b5a245e0987ccfcd3f1b7
-
SHA1
563e5628698633b835ee4299107157e857b2b438
-
SHA256
7dd2d4136ddf4fa8a9b7822929ba5f9c819911e254e3187abdb098bf3c144600
-
SHA512
73ee9d2478e6910390bc9c755f3230ca2a6b6b298c7b368641409d296e859d3744c99d804e372c4b87e3f34bb04a587eb6ef6205e4bdcaba4fb37d94862edfd9
-
SSDEEP
6144:sd6RtMhSy21xOahsA/i0PwiEgk9LlIHBfz/:sThoOWd/BhsOhfz/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/53237c2782ec5dbdabb8350a3ef5e8c25662436052e92ae1300f3f41be984ea6.exe
Files
-
7dd2d4136ddf4fa8a9b7822929ba5f9c819911e254e3187abdb098bf3c144600.zip
Password: infected
-
53237c2782ec5dbdabb8350a3ef5e8c25662436052e92ae1300f3f41be984ea6.exe.exe windows:5 windows x86 arch:x86
c654356de6bb7b8c3d7bc83fc8ab415b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceExA
GetLocaleInfoW
GetSystemTimeAdjustment
HeapCreate
GetExitCodeProcess
ExitThread
FindNextVolumeMountPointW
ReleaseSemaphore
LCMapStringA
GetConsoleAliasesW
GlobalUnfix
GetHandleInformation
ReadConsoleOutputA
CreateTimerQueueTimer
GetProcessWorkingSetSize
LocalAlloc
SetConsoleCtrlHandler
BeginUpdateResourceA
SetEnvironmentVariableA
VirtualProtect
GetConsoleCursorInfo
ScrollConsoleScreenBufferA
lstrcpyW
GetTickCount
GetFileAttributesExA
GetCurrentProcess
LoadResource
FreeLibrary
MapUserPhysicalPages
GetProfileIntW
GetModuleHandleExA
lstrlenA
EnumDateFormatsExA
FindResourceA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetModuleFileNameW
RaiseException
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapValidate
IsBadReadPtr
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetLastError
WriteFile
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
MultiByteToWideChar
CloseHandle
CreateFileA
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
SetStdHandle
GetStringTypeW
LCMapStringW
FlushFileBuffers
ReadFile
SetEndOfFile
GetProcessHeap
CreateFileW
user32
GetProcessDefaultLayout
advapi32
BackupEventLogW
RegReplaceKeyA
OpenSCManagerA
ReadEventLogW
AbortSystemShutdownA
RegReplaceKeyW
EnumDependentServicesA
RegCreateKeyW
ObjectPrivilegeAuditAlarmA
PrivilegedServiceAuditAlarmW
Sections
.text Size: 252KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 30.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ