Static task
static1
Behavioral task
behavioral1
Sample
2646461707172485e60002d3ed77c130ccb02fd2ffc8a97756100d3194991858.exe
Resource
win7-20240704-en
General
-
Target
2646461707172485e60002d3ed77c130ccb02fd2ffc8a97756100d3194991858
-
Size
8.2MB
-
MD5
d0903c92f559b7b635ad4fe5f1ec23c9
-
SHA1
825169238eb46f4167e554e1f53d4b2fe7cadd74
-
SHA256
2646461707172485e60002d3ed77c130ccb02fd2ffc8a97756100d3194991858
-
SHA512
d638fe4c3bfc11b4717ad6eeb8ea43aa93ac37bac92af8cf4d771f60e058b15cea3bdb1f4f043b081df7fab13972a7465bc7b69410b703cf6247aa6684e2143c
-
SSDEEP
196608:Ieq1uQZt6j8lRv935xxRtXLRkxCeO4fdU:Af8j8l1bRt70O4m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2646461707172485e60002d3ed77c130ccb02fd2ffc8a97756100d3194991858
Files
-
2646461707172485e60002d3ed77c130ccb02fd2ffc8a97756100d3194991858.exe windows:6 windows x86 arch:x86
efef0211c7bdc64f9e7ed338ef700333
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedDecrement
LeaveCriticalSection
WaitForSingleObject
Sleep
SetEvent
CloseHandle
CreateEventA
GetCurrentThreadId
SetLastError
CancelIo
InterlockedExchange
lstrlenW
CreateEventW
ResetEvent
WideCharToMultiByte
ResumeThread
OpenProcess
GetFileAttributesA
GetSystemDirectoryA
GetThreadContext
VirtualAllocEx
CreateProcessA
SetThreadContext
GetExitCodeProcess
VerSetConditionMask
VerifyVersionInfoW
GetStartupInfoW
ReadFile
GetModuleFileNameA
GetFileSizeEx
WriteProcessMemory
FindFirstFileA
VirtualProtect
Toolhelp32ReadProcessMemory
GetCurrentProcess
WriteFile
DeviceIoControl
GetModuleFileNameW
FindNextFileA
EnterCriticalSection
GetEnvironmentVariableA
FindClose
LocalAlloc
CreateFileW
GetCurrentDirectoryA
DuplicateHandle
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
CreateFileA
Process32FirstW
GetSystemInfo
LoadLibraryW
CreateThread
GetProcAddress
ExitProcess
ReadProcessMemory
GetCurrentProcessId
GlobalMemoryStatusEx
GetModuleHandleW
FreeLibrary
CopyFileW
GetConsoleWindow
WinExec
GetTickCount
IsDebuggerPresent
ReadConsoleW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapFree
VirtualFree
FlushFileBuffers
CreatePipe
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleHandleExW
ExitThread
RtlUnwind
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
LocalFree
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
OutputDebugStringW
MultiByteToWideChar
GetStringTypeW
WaitForSingleObjectEx
GetCurrentThread
EncodePointer
QueryPerformanceCounter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
user32
GetCursorPos
GetInputState
PostThreadMessageA
ShowWindow
FindWindowA
advapi32
EnumServicesStatusA
RegOpenKeyA
CloseServiceHandle
OpenSCManagerW
RegDeleteKeyW
GetUserNameW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegQueryValueExW
ole32
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitialize
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
ws2_32
connect
recv
socket
setsockopt
send
WSAStartup
select
gethostbyname
closesocket
WSAIoctl
WSACleanup
htons
shlwapi
PathIsDirectoryA
winmm
timeGetTime
Sections
.text Size: 661KB - Virtual size: 661KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.k.- Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Ukh Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.9K8 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ