Static task
static1
Behavioral task
behavioral1
Sample
d0af811164d3baeca7fb42738a122098de21776033548cb3427b3e6c8393e05bN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d0af811164d3baeca7fb42738a122098de21776033548cb3427b3e6c8393e05bN.exe
Resource
win10v2004-20240802-en
General
-
Target
d0af811164d3baeca7fb42738a122098de21776033548cb3427b3e6c8393e05bN
-
Size
35KB
-
MD5
0a7e419074c0409c9c4e333ba7f2c200
-
SHA1
bbc2b431c49e84fd75f4fbd9269dc3b06ce123d8
-
SHA256
d0af811164d3baeca7fb42738a122098de21776033548cb3427b3e6c8393e05b
-
SHA512
2c474080cc868351584470c4138b18d445431fa4cd9b357ef4ae9b0a757872b5f3047c021756fc114fce7e2b356fc718365241314d35a2619ea7d305abcac35d
-
SSDEEP
768:m2VJyePxXbLYTSsrUIZ6kyzrLhRNiouDFELVJPG5p5:m2By9QIZgzrlLiomKLVJP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0af811164d3baeca7fb42738a122098de21776033548cb3427b3e6c8393e05bN
Files
-
d0af811164d3baeca7fb42738a122098de21776033548cb3427b3e6c8393e05bN.exe windows:4 windows x86 arch:x86
ca693519786fae7cdeb8d7cc3391106b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
SetFileAttributesA
CopyFileA
Sleep
CloseHandle
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetCommandLineA
WriteFile
DeleteFileA
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
CreateMutexA
FindClose
FindNextFileA
FindFirstFileA
PeekNamedPipe
GetStartupInfoA
CreatePipe
GetModuleHandleA
GetLastError
GetLogicalDriveStringsA
ReadFile
GetDriveTypeA
user32
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
PostQuitMessage
MessageBoxA
BeginPaint
EndPaint
DefWindowProcA
wsprintfA
DestroyWindow
CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
shell32
ShellExecuteA
msvcrt
_CxxThrowException
_endthread
fclose
fwrite
fseek
fopen
fread
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
??2@YAPAXI@Z
__p__fmode
__set_app_type
_except_handler3
_controlfp
__CxxFrameHandler
memmove
exit
_beginthread
??3@YAXPAX@Z
rename
__p__commode
msvcp60
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xlen@std@@YAXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
ws2_32
htons
inet_addr
socket
inet_ntoa
gethostbyname
WSAStartup
closesocket
recv
send
connect
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ