Static task
static1
Behavioral task
behavioral1
Sample
db3a45463a04d366a72ac0a15fa98670N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
db3a45463a04d366a72ac0a15fa98670N.exe
Resource
win10v2004-20240802-en
General
-
Target
db3a45463a04d366a72ac0a15fa98670N
-
Size
224KB
-
MD5
db3a45463a04d366a72ac0a15fa98670
-
SHA1
8296a3dc68137c3ac6b26e20c4401e8312eb1bdb
-
SHA256
c389ae31e5d26454df4a718bebf5810ccdb4ac0fcc3fae7c49bce4810c8e8b8f
-
SHA512
a12d2123d61c829cabb1cdef3d6488b29553cb0df7139629fb674fab5505dd9222af5ecdf84be7ede0933cac22592fc82a80d28548df1f5f275ce8dd71bd47a4
-
SSDEEP
3072:NrPPxiBl6w+KtgXLWUoUkla8wIHdIHjFEzow:NzPxiGw+KtgXL1nkla8wHjqP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db3a45463a04d366a72ac0a15fa98670N
Files
-
db3a45463a04d366a72ac0a15fa98670N.exe windows:4 windows x86 arch:x86
00e103a7d7726c1fbaad4e1f661c5a9c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
GetVersion
ExitProcess
RtlUnwind
GetLastError
CloseHandle
WriteFile
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetProcAddress
GetModuleHandleA
DebugBreak
InterlockedDecrement
OutputDebugStringA
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
IsBadWritePtr
IsBadReadPtr
HeapValidate
MultiByteToWideChar
LCMapStringA
LCMapStringW
FlushFileBuffers
SetStdHandle
SetConsoleCtrlHandler
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
SetUnhandledExceptionFilter
IsBadCodePtr
GetStringTypeA
GetStringTypeW
Sections
.text Size: 180KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ