Static task
static1
Behavioral task
behavioral1
Sample
f88fc7d002d6132408a4ee98e498af3783d4a0288cecdd2f7c6b203ba8ae32b7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f88fc7d002d6132408a4ee98e498af3783d4a0288cecdd2f7c6b203ba8ae32b7.exe
Resource
win10v2004-20240802-en
General
-
Target
f88fc7d002d6132408a4ee98e498af3783d4a0288cecdd2f7c6b203ba8ae32b7
-
Size
1.4MB
-
MD5
669829c2181eca7b4d8531c11f424d9a
-
SHA1
e566781f57db07fca8fbeafe91e9e15606ef4354
-
SHA256
f88fc7d002d6132408a4ee98e498af3783d4a0288cecdd2f7c6b203ba8ae32b7
-
SHA512
7711a390f8e92b8b23ea0b6a533b1bf9d09fa580f9a1f5e8c4257abaeb374795ffd042bb0e4aa672d84dbb8e5c2cb42dc2cbbdfe4ac82a7561fad41cdc1526d9
-
SSDEEP
24576:QEs8gpzmLbLXVrJKIqjbbZ208y/jSznPSznGAK8cO2w5vWg+sAnTEf04vBbslamt:hb5lKNbbY4jSznPSznfcOBWg+Sf04pab
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f88fc7d002d6132408a4ee98e498af3783d4a0288cecdd2f7c6b203ba8ae32b7
Files
-
f88fc7d002d6132408a4ee98e498af3783d4a0288cecdd2f7c6b203ba8ae32b7.exe windows:6 windows x86 arch:x86
b8cc257a6ad88204f188e73edc15477c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
CloseHandle
GetLastError
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WriteFile
GetFileType
SetFilePointer
SetEndOfFile
ReadFile
VirtualAlloc
GetSystemInfo
GetEnvironmentVariableA
VirtualFree
GetFileAttributesA
GetFileSize
GetFileAttributesExA
LeaveCriticalSection
EnterCriticalSection
GetFullPathNameA
TlsSetValue
TlsGetValue
TlsFree
SetLastError
TlsAlloc
WaitForSingleObject
GetCurrentThreadId
GetStdHandle
FormatMessageA
LoadLibraryA
GetThreadLocale
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
DeleteCriticalSection
ExitThread
InitializeCriticalSection
CreateEventA
SetEvent
TerminateThread
OpenFileMappingA
GetHandleInformation
IsBadReadPtr
GetFileInformationByHandle
GetTempPathA
GetTempFileNameA
GetSystemDefaultLangID
WideCharToMultiByte
GetFullPathNameW
MultiByteToWideChar
GetUserDefaultLangID
DeleteFileA
SetThreadPriority
CreateProcessA
SetErrorMode
GetCommandLineA
GetACP
SetConsoleCtrlHandler
FlushFileBuffers
GetSystemTimeAsFileTime
GetCurrentProcess
SleepEx
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
GetModuleFileNameA
VirtualQuery
GetCurrentThread
GetFileSizeEx
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteConsoleW
GetConsoleCP
GetConsoleMode
SetStdHandle
QueryPerformanceFrequency
GetCommandLineW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
OutputDebugStringW
CompareStringW
LCMapStringW
SetFilePointerEx
ReadConsoleW
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
CreateFileW
imagehlp
StackWalk64
SymCleanup
SymInitialize
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ