Static task
static1
Behavioral task
behavioral1
Sample
1c4d8638f93406318a863dac74fba2d9196bb5d22f8809373e46a515023a1773.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1c4d8638f93406318a863dac74fba2d9196bb5d22f8809373e46a515023a1773.exe
Resource
win10v2004-20240802-en
General
-
Target
8109accc4c804c6ce4b8ab1bd6067149.zip
-
Size
2.1MB
-
MD5
82dea863a2d46543aabafe3b78fd7d93
-
SHA1
27dd0c6c22a1eb2325c41e4fca2543be35915a2c
-
SHA256
e2d4bf70f1c56365ab0521c69a4789bc497bd5bfaa7cc1f6a911c63935661784
-
SHA512
042fc73fc99a48f50147d0d45f9bc26bb5112cf70b2874725ea178e0e1c1301a31822d7e00bb0832c33000c4ef0b950e36960cfee41abc4f015a85078f14cfd1
-
SSDEEP
49152:MVVMi+oV7fSRJIyOCuH4rlblHDs/PbkTpsgVLI:MVV+oV7qRJIyOCuHGblA/PMOge
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1c4d8638f93406318a863dac74fba2d9196bb5d22f8809373e46a515023a1773
Files
-
8109accc4c804c6ce4b8ab1bd6067149.zip.zip
Password: infected
-
1c4d8638f93406318a863dac74fba2d9196bb5d22f8809373e46a515023a1773.exe windows:4 windows x86 arch:x86
Password: infected
53b338a5a343440770be2403e59415fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesExA
HeapDestroy
HeapFree
QueryPerformanceCounter
Sleep
HeapCreate
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleFileNameA
GetTickCount
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
CloseHandle
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CbOb Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_READ