Static task
static1
Behavioral task
behavioral1
Sample
7ac4b2243222fe1a33884059a81a24c0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ac4b2243222fe1a33884059a81a24c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
7ac4b2243222fe1a33884059a81a24c0N.exe
-
Size
861KB
-
MD5
7ac4b2243222fe1a33884059a81a24c0
-
SHA1
713e21c07eb55029b5ad3cd3445b74c2408e5176
-
SHA256
671afef7df7ed8f6cd640f5fd6aeb5a37feafdae6c0a7a05b7bcfcf5e956a145
-
SHA512
232dd03d090ee0922744baa284960833e713613c95ad11d3cb308527528d2cff786fab6f4b05a8619db9480ebb3e665470b844cf3c7754fd9f1e40f5bcc6371b
-
SSDEEP
12288:4kVuT2Goommzn+7qBQpFm6HDruX8g5l76CfGKigGf75HjXByrE77ifJ4:4kIT2GNzn++GpF7usg5l7figQ5DXByX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ac4b2243222fe1a33884059a81a24c0N.exe
Files
-
7ac4b2243222fe1a33884059a81a24c0N.exe.exe windows:5 windows x86 arch:x86
f37295a71096ccb7f8bd10df4a9c36a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
CreateToolhelp32Snapshot
GetVersionExA
CloseHandle
GetTempPathA
SetErrorMode
CopyFileA
GetModuleFileNameA
GetProcAddress
GetLastError
ReadFile
Thread32Next
CreateProcessA
Sleep
Thread32First
OpenThread
OpenProcess
WriteFile
ExpandEnvironmentStringsA
GetProcessHeap
HeapFree
GetCurrentProcess
Process32First
GetSystemDirectoryA
Module32First
Process32Next
Module32Next
SetFilePointer
GetTickCount
GetFileAttributesA
CreateMutexA
WaitForSingleObject
TerminateThread
ExitThread
GetExitCodeThread
CreateThread
SetThreadContext
TerminateProcess
DuplicateHandle
GetFileTime
SetFileAttributesA
SetFileTime
HeapAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
SetHandleCount
GetFileType
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEndOfFile
lstrlenA
GetFileSize
CreateFileA
GetComputerNameA
user32
EnumChildWindows
GetForegroundWindow
SendMessageA
GetWindowRect
GetClassNameA
WaitForInputIdle
advapi32
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptHashData
LookupPrivilegeValueA
GetUserNameA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
psapi
GetModuleFileNameExA
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 729KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EBSS Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ