Static task
static1
Behavioral task
behavioral1
Sample
f40888d76450cb6ea83828932a67d1c64b4a209df858a9b477028b08680aed98.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f40888d76450cb6ea83828932a67d1c64b4a209df858a9b477028b08680aed98.exe
Resource
win10v2004-20240802-en
General
-
Target
f40888d76450cb6ea83828932a67d1c64b4a209df858a9b477028b08680aed98
-
Size
601KB
-
MD5
d681d4e789a33218928743cb456b74eb
-
SHA1
14e5a6d746abdb516b3028df328d200168bd07c2
-
SHA256
f40888d76450cb6ea83828932a67d1c64b4a209df858a9b477028b08680aed98
-
SHA512
8e7ea83279592db4d449e14091f3e4f298df60d70536e14691bba8c5d50a64a0ff25a4d2270705f60b0951c2ba0b7c0fd216124aaf5eb0ecd12fabc7dcca8a70
-
SSDEEP
12288:ZYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+sqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f40888d76450cb6ea83828932a67d1c64b4a209df858a9b477028b08680aed98
Files
-
f40888d76450cb6ea83828932a67d1c64b4a209df858a9b477028b08680aed98.exe windows:4 windows x64 arch:x64
8bfc6e14b01461b9d1aae227c0446098
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
kernel32
CloseHandle
CreateFileW
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFullPathNameW
GetLastError
GetLongPathNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MoveFileW
OpenProcess
OpenThread
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueueUserAPC
ReadProcessMemory
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAllocEx
VirtualFreeEx
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WriteFile
WriteProcessMemory
lstrlenW
msvcrt
__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_fmode
_initterm
_lock
_onexit
_unlock
_wgetenv
abort
calloc
exit
fprintf
free
fwrite
iswctype
malloc
memcpy
memset
printf
signal
strlen
strncmp
vfprintf
wcscmp
wcscpy
wcstol
vprintf
_wcsicmp
shell32
CommandLineToArgvW
shlwapi
PathFileExistsW
user32
wsprintfW
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 1012B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 258KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE