Static task
static1
Behavioral task
behavioral1
Sample
b072ef1aeeb8f75c80fe2af2296cb7305a3fe9289d38b4048e4e4081b81180e8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b072ef1aeeb8f75c80fe2af2296cb7305a3fe9289d38b4048e4e4081b81180e8.exe
Resource
win10v2004-20240802-en
General
-
Target
b072ef1aeeb8f75c80fe2af2296cb7305a3fe9289d38b4048e4e4081b81180e8
-
Size
790KB
-
MD5
8c3bf4d13e2feac428f51431aa2f2620
-
SHA1
9ef7a14acbcd52067ba0281a880dfea3b32738eb
-
SHA256
b072ef1aeeb8f75c80fe2af2296cb7305a3fe9289d38b4048e4e4081b81180e8
-
SHA512
0a411be8a70d812b28dd74f7354c32960a1ef9a1ad3a7e8b751e77db5b99c8164fab181656c1f2fa4e073145d2e44d30edeb614c9b78c10950595850b79c882d
-
SSDEEP
24576:KwLbm+wGTKGm2brY1PywnT5YDVjXKFl8vfBV21:DbmPGm2g1PRYRzw8r21
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b072ef1aeeb8f75c80fe2af2296cb7305a3fe9289d38b4048e4e4081b81180e8
Files
-
b072ef1aeeb8f75c80fe2af2296cb7305a3fe9289d38b4048e4e4081b81180e8.exe windows:6 windows x86 arch:x86
3504aa67114e1f3343142b3c63b8c352
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
GetLastError
GetFileType
SetFilePointer
Sleep
TlsSetValue
TlsGetValue
TlsFree
SetLastError
TlsAlloc
CloseHandle
WaitForSingleObject
VirtualAlloc
GetSystemInfo
GetEnvironmentVariableA
VirtualFree
GetFileAttributesA
GetFileSize
GetFileAttributesExA
LeaveCriticalSection
EnterCriticalSection
GetFullPathNameA
SetEndOfFile
ReadFile
GetCurrentThreadId
GetStdHandle
FormatMessageA
LoadLibraryA
GetThreadLocale
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
FreeLibrary
CreateFileA
DeleteCriticalSection
ExitThread
InitializeCriticalSection
CreateEventA
SetEvent
TerminateThread
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
GetHandleInformation
IsBadReadPtr
GetFileInformationByHandle
GetTempPathA
GetTempFileNameA
GetSystemDefaultLangID
WideCharToMultiByte
GetFullPathNameW
MultiByteToWideChar
GetUserDefaultLangID
DeleteFileA
SetThreadPriority
CreateProcessA
SetErrorMode
GetCommandLineA
GetACP
SetConsoleCtrlHandler
FlushFileBuffers
GetSystemTimeAsFileTime
GetCurrentProcess
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
GetModuleFileNameA
VirtualQuery
GetCurrentThread
CreateFileW
GetFileSizeEx
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
RaiseException
GetModuleHandleExW
GetModuleFileNameW
WriteConsoleW
ExitProcess
GetConsoleCP
GetConsoleMode
SetStdHandle
QueryPerformanceFrequency
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
HeapSize
OutputDebugStringW
SetFilePointerEx
ReadConsoleW
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
imagehlp
StackWalk64
SymCleanup
SymInitialize
Sections
.text Size: 653KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ