Static task
static1
Behavioral task
behavioral1
Sample
ua(1).exe
Resource
win10v2004-20240802-en
General
-
Target
ua(1).exe
-
Size
45.5MB
-
MD5
b151db69364ad0c6989c8db767e25826
-
SHA1
ca9cacda6e0e3b47ebaefe8f6ffe501aac205250
-
SHA256
1a787a0ab3cace5a08857297b4ce76ad8209b1e412e5f5906476752a2d62d0c4
-
SHA512
833341b231ad7efd2d540a2deb6fd646a2bc1eebd86f5b965f23583ef2066b33d931ff4998fcb7d050ea9e13cfe901d49884165ca5afff5150edd51848cf0ed5
-
SSDEEP
786432:0Z7vAXI1b7LFhAw0deEMgxBFTBdsUueZ+xmCdCofU/04Bqn:c0YhJ0wEDBmo1CdCofU/q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ua(1).exe
Files
-
ua(1).exe.exe windows:6 windows x64 arch:x64
5510e567dee0eefb54acf14b7e1508db
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
user32
GetClassNameA
advapi32
CryptGetUserKey
shell32
SHGetFolderPathW
ole32
CoUninitialize
oleaut32
VariantClear
msvcp140
?good@ios_base@std@@QEBA_NXZ
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
ioctlsocket
shlwapi
StrStrW
ntdll
NtRaiseHardError
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 938KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 37.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 45.4MB - Virtual size: 45.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ