Static task
static1
Behavioral task
behavioral1
Sample
59b1fe9b08cd99c99bf8a31530fd60d66a1cad3ec75b7c24a3e82350c2884844N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
59b1fe9b08cd99c99bf8a31530fd60d66a1cad3ec75b7c24a3e82350c2884844N.exe
Resource
win10v2004-20240910-en
General
-
Target
59b1fe9b08cd99c99bf8a31530fd60d66a1cad3ec75b7c24a3e82350c2884844N
-
Size
9.7MB
-
MD5
34818ae30da580ccbef4f9c016a794d0
-
SHA1
4e320c8d92f6b36bd6f5b0972e5e9eec7e788f2d
-
SHA256
59b1fe9b08cd99c99bf8a31530fd60d66a1cad3ec75b7c24a3e82350c2884844
-
SHA512
ab995e7dfdca5e6de45831e8dcdc7bf6a9acfe269aba5fe2012483627354a5f76b2fed16d87f7ffa4c1eb7e123d7f28c0bbd1ecd573eeedaba3306ca306ae634
-
SSDEEP
196608:gnFqnhgJuP3LAhCiVXOWt+A1oMuWr45hrr2L:emS+LJseJWGhrr2L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59b1fe9b08cd99c99bf8a31530fd60d66a1cad3ec75b7c24a3e82350c2884844N
Files
-
59b1fe9b08cd99c99bf8a31530fd60d66a1cad3ec75b7c24a3e82350c2884844N.exe windows:5 windows x86 arch:x86
6013d0b9fb6901d1d5e58a9ae7072103
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleBaseNameA
GetModuleFileNameExA
EnumProcessModules
EnumProcesses
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
GetTempFileNameA
CreateFileA
lstrcpyA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetVolumeInformationA
GetDriveTypeA
lstrcpynA
WaitForSingleObject
CreateMutexA
Thread32Next
SuspendThread
ResumeThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
CreateDirectoryA
GetTempPathA
DeleteFileA
FreeResource
UpdateResourceA
LockResource
LoadResource
SizeofResource
FindResourceExA
EnumResourceLanguagesA
EnumResourceNamesA
SetFileTime
GetFileTime
FreeLibrary
FindResourceA
LoadLibraryExA
GetCurrentProcess
SetEvent
OpenEventA
Process32Next
Process32First
FindClose
FindNextFileA
FindFirstFileA
EndUpdateResourceA
EnumResourceTypesA
BeginUpdateResourceA
GetTickCount
CopyFileA
ReleaseMutex
lstrlenA
lstrcatA
WriteFile
GetModuleFileNameA
CreateProcessA
CloseHandle
Sleep
GetLastError
HeapSize
GetLocaleInfoA
GetUserDefaultLCID
CreateThread
FlushFileBuffers
SetStdHandle
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
LoadLibraryA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetFullPathNameA
GetCurrentThread
WideCharToMultiByte
GetModuleHandleA
GetVersionExA
lstrcmpA
SetFilePointer
GetSystemTimeAsFileTime
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
HeapAlloc
HeapFree
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetCommandLineA
GetStartupInfoA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
VirtualFree
QueryPerformanceCounter
VirtualAlloc
HeapReAlloc
ReadFile
GetConsoleCP
user32
wsprintfA
wvsprintfA
advapi32
RegQueryValueExA
RegCreateKeyA
RegEnumKeyExA
FreeSid
AllocateAndInitializeSid
EqualSid
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
OpenThreadToken
GetTokenInformation
shell32
ShellExecuteA
SHGetSpecialFolderPathA
shlwapi
SHRegCreateUSKeyA
SHRegCloseUSKey
wininet
InternetCloseHandle
HttpOpenRequestA
InternetOpenA
InternetConnectA
InternetQueryOptionA
HttpQueryInfoA
InternetOpenUrlA
InternetSetFilePointer
HttpSendRequestA
InternetReadFile
ws2_32
WSAStartup
gethostbyname
Sections
.text Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ