Static task
static1
Behavioral task
behavioral1
Sample
f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78.exe
Resource
win11-20240802-en
General
-
Target
f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78
-
Size
807KB
-
MD5
8da384b2427b8397a5934182c159c257
-
SHA1
7bcd2d32a19c1ac7bd014dc9e64b806fdff5f5de
-
SHA256
f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78
-
SHA512
3c4b1736efa48a4897769f12df488e60737523eaffc886ecfbd5b7191f058749bdb4a36feb067e8ca0ef418a7602b3390b6cf465412b88a4ba2fce8a4d670a89
-
SSDEEP
12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAu:u4s+oT+NXBLi0rjFXvyHBlb6CZa8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78
Files
-
f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78.exe windows:6 windows x86 arch:x86
6384241afa3b18e8b84aff69eaa01910
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageA
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
GetVolumePathNamesForVolumeNameW
ResetEvent
GetConsoleWindow
CopyFileW
FindVolumeClose
ExitProcess
LocalFree
SetVolumeMountPointW
CloseHandle
Process32Next
GlobalAlloc
GetLastError
Sleep
CreateToolhelp32Snapshot
SetFileAttributesW
PostQueuedCompletionStatus
GetFileAttributesW
CreateMutexA
GetQueuedCompletionStatus
SetThreadPriority
SetEvent
WriteConsoleW
CreateFileW
Wow64DisableWow64FsRedirection
lstrlenW
GetCurrentProcess
FindFirstVolumeW
Process32First
GetFileSizeEx
HeapSize
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
MultiByteToWideChar
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
WaitForSingleObjectEx
GetExitCodeThread
LCMapStringEx
EncodePointer
DecodePointer
QueryPerformanceFrequency
GetProcAddress
CompareStringEx
GetCPInfo
GetLocaleInfoEx
GetStringTypeW
SetLastError
RtlUnwind
InterlockedPushEntrySList
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
CreateEventW
advapi32
CryptDestroyKey
CryptImportKey
FreeSid
OpenProcessToken
SetNamedSecurityInfoW
LookupPrivilegeValueA
AllocateAndInitializeSid
CryptEncrypt
CryptReleaseContext
SetEntriesInAclA
AdjustTokenPrivileges
CryptAcquireContextA
CryptGenRandom
user32
ShutdownBlockReasonCreate
ShowWindow
crypt32
CryptStringToBinaryA
CryptBinaryToStringA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
rstrtmgr
RmGetList
RmRegisterResources
RmStartSession
RmEndSession
mpr
WNetOpenEnumA
WNetCloseEnum
WNetAddConnection2A
WNetEnumResourceA
Sections
.text Size: 622KB - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ