Static task
static1
Behavioral task
behavioral1
Sample
Ohz2N1pNjdq5HyRkYOMC3ZC.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Ohz2N1pNjdq5HyRkYOMC3ZC.exe
Resource
win10v2004-20240802-en
General
-
Target
Ohz2N1pNjdq5HyRkYOMC3ZC.exe
-
Size
41.9MB
-
MD5
95a49ff1dbd85502dda4df87b2bc5101
-
SHA1
25c905816a6e4b8abcf9eb0a382cc7cc470d7b2e
-
SHA256
92ad87fe01320733afcb04a8b6f129a71dcd1769cab83326e8eee1175447af27
-
SHA512
c95fc5005cf24816621091ae52adb74dfb66698c7c277c776ec1545b806d86a28d98f3814e926f87daaca28323fce3b44ffb2aec958ccff1643ca83b2d5184a7
-
SSDEEP
786432:BXv8WsMlcj0AsXmQlFTD1JF9S5iOFW9hc2K4pRdvHI+QcnpDf:BXEAWjN4pFNs5A9h1F5Qc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ohz2N1pNjdq5HyRkYOMC3ZC.exe
Files
-
Ohz2N1pNjdq5HyRkYOMC3ZC.exe.exe windows:6 windows x64 arch:x64
92ac1b8f46d91c02a3b0c7e1d89a12ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
user32
GetWindowThreadProcessId
advapi32
CryptGetProvParam
shell32
SHGetFolderPathW
ole32
CoSetProxyBlanket
oleaut32
SysFreeString
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
normaliz
IdnToAscii
wldap32
ord22
crypt32
CertFreeCertificateChain
ws2_32
select
shlwapi
StrStrW
ntdll
NtLoadDriver
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
_atoi64
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-time-l1-1-0
_tzset
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 939KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 538KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 35.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 41.9MB - Virtual size: 41.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ