Static task
static1
Behavioral task
behavioral1
Sample
5ebfe778f3ce4565a576384202562eb9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5ebfe778f3ce4565a576384202562eb9.exe
Resource
win10v2004-20240802-en
General
-
Target
5ebfe778f3ce4565a576384202562eb9.exe
-
Size
279KB
-
MD5
5ebfe778f3ce4565a576384202562eb9
-
SHA1
0551919df262417d935da2c4d8c98bc2535c4d99
-
SHA256
5d7f8b38a4d31ff73c36b0d3d0bbd52b0de8574127bfdc22bae0b84e440c595b
-
SHA512
d2643424eb11ad773477680d4a728055008842bc65ddb7412b8824023b90b640044e71a06cb4fe304d9e89fbae00bcaf37eb4c1d8fce146751d2bb380739fabf
-
SSDEEP
6144:5L4rmC68GETrMw94r+V5yClebRSS6nSy:5cr768n9DTyCY4S6nSy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ebfe778f3ce4565a576384202562eb9.exe
Files
-
5ebfe778f3ce4565a576384202562eb9.exe.exe windows:5 windows x86 arch:x86
ad5e7fce0417e12bb0931a47422a42c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameA
SearchPathW
SetPriorityClass
CopyFileExW
GetNumaProcessorNode
GetConsoleAliasExesLengthA
InterlockedIncrement
OpenJobObjectA
QueryDosDeviceA
GetComputerNameW
CallNamedPipeW
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetUserDefaultLangID
GetEnvironmentStrings
LoadLibraryW
GetConsoleMode
Sleep
CopyFileW
WriteConsoleOutputA
HeapDestroy
GetFileAttributesA
GlobalFlags
GetModuleFileNameW
GetBinaryTypeW
GetStartupInfoW
GetCommandLineW
WritePrivateProfileStringW
DisconnectNamedPipe
CreateDirectoryA
InterlockedExchange
FillConsoleOutputCharacterW
GetLastError
GetProcAddress
SetStdHandle
EnterCriticalSection
SearchPathA
BuildCommDCBW
OpenWaitableTimerW
LocalAlloc
FindAtomA
FoldStringW
GetDefaultCommConfigA
SetConsoleTitleW
GetModuleHandleA
GetShortPathNameW
SetCalendarInfoA
GlobalReAlloc
SetFileAttributesW
GetVolumeInformationW
CreateFileA
DebugActiveProcess
HeapFree
HeapAlloc
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
FlushFileBuffers
ReadFile
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
user32
SetFocus
GetUserObjectInformationA
advapi32
RegCreateKeyA
Sections
.text Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 35.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ