Static task
static1
Behavioral task
behavioral1
Sample
2dea28403f8538f09debdf4e259076c0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2dea28403f8538f09debdf4e259076c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
2dea28403f8538f09debdf4e259076c0N
-
Size
3.9MB
-
MD5
2dea28403f8538f09debdf4e259076c0
-
SHA1
017145081cb2e8e90ee66e0a09e224e7ddbd7b34
-
SHA256
7510fb8be114a816cc6990b87d5420cd05543b423803d0d37b1bb493186c4fcd
-
SHA512
73d5d447b2d356115afca9c045fdff8470c4fe2b8089f4efcf2303cca0e5976683b38e543dd09bfe6f11499339190ac22c4475b47eee89dad282cfe35e4538d4
-
SSDEEP
49152:F0ktHFMh6zvqnvs0+vPO57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTU7c+DNE/l6RROQ+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dea28403f8538f09debdf4e259076c0N
Files
-
2dea28403f8538f09debdf4e259076c0N.exe windows:5 windows x86 arch:x86
ac85d85b1b04f75921f1ad8ef27f8e95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
WSAStartup
WSACleanup
inet_ntoa
shell32
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoInitialize
advapi32
RegOpenKeyExW
RegCloseKey
RegSetValueExW
user32
ShowWindow
kernel32
WriteConsoleW
SetStdHandle
ReadConsoleW
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
CreateFileW
HeapSize
OutputDebugStringW
WaitForSingleObjectEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcAddress
VirtualAlloc
VirtualAllocEx
TerminateProcess
GetExitCodeProcess
CreateThread
GetLastError
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
Wow64GetThreadContext
ResumeThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetTickCount
GetModuleFileNameW
GetModuleHandleA
CreateProcessW
SetCurrentDirectoryW
CreateDirectoryW
GetConsoleWindow
FormatMessageW
WideCharToMultiByte
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
SetEndOfFile
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetProcessHeap
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
Sections
.text Size: 507KB - Virtual size: 506KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ