Static task
static1
Behavioral task
behavioral1
Sample
79509c63ae7a300bad12d8d15cefb7b125808a9568e0c5b1c9fd66085d471175.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
79509c63ae7a300bad12d8d15cefb7b125808a9568e0c5b1c9fd66085d471175.exe
Resource
win10v2004-20240802-en
General
-
Target
79509c63ae7a300bad12d8d15cefb7b125808a9568e0c5b1c9fd66085d471175.exe
-
Size
127KB
-
MD5
4af8136649c5c751a23672673107da98
-
SHA1
10a7f868187b4b2df3513a4843cab509675bb114
-
SHA256
79509c63ae7a300bad12d8d15cefb7b125808a9568e0c5b1c9fd66085d471175
-
SHA512
817b3460babba9a9150a8f4c34e65ca1839f1b12b397322bd255bb6b1d258cc2840cc8f681785b6f9b354dd679cc263e8a99fc53e3e121435538c3140459b4a7
-
SSDEEP
3072:casU1M8AwkEDYujzDqQ8ViDNhlpTMKHqifBO5:c22KkUF+Q8Ah3fI5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79509c63ae7a300bad12d8d15cefb7b125808a9568e0c5b1c9fd66085d471175.exe
Files
-
79509c63ae7a300bad12d8d15cefb7b125808a9568e0c5b1c9fd66085d471175.exe.exe windows:6 windows x86 arch:x86
813e80154cd934069bb673dffeae295e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEvent
ResetEvent
DeleteCriticalSection
CreateEventA
FindFirstFileW
VirtualFree
FindNextFileW
VirtualAlloc
FindClose
GetNativeSystemInfo
CreateThread
MultiByteToWideChar
GetModuleHandleW
WriteConsoleW
HeapReAlloc
HeapSize
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
LeaveCriticalSection
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFileType
LCMapStringW
CompareStringW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
RaiseException
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
FlushFileBuffers
GetFileSize
MoveFileExW
CloseHandle
DeleteFileW
Sleep
CreateFileW
SetFilePointer
WriteFile
ReadFile
GetProcessHeap
HeapAlloc
GetLastError
GetEnvironmentStringsW
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
DecodePointer
user32
PeekMessageA
MessageBoxA
CharLowerW
advapi32
CryptAcquireContextW
CryptDestroyKey
CryptReleaseContext
CryptEncrypt
CryptGenRandom
CryptDecrypt
CryptExportKey
CryptImportKey
CryptGenKey
shlwapi
PathRemoveExtensionW
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ