Static task
static1
Behavioral task
behavioral1
Sample
27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d.exe
Resource
win10v2004-20240802-en
General
-
Target
27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d.exe
-
Size
415KB
-
MD5
1c5083792acfccf5d90db80884569ace
-
SHA1
6be243663a2d173dcd728146f2a3d1a5a974ff38
-
SHA256
27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d
-
SHA512
8af309adcaed0055ca8b2c879a1ff16e9d0d853ab3837c94719d09c03bf27b32125581f525ef99caa4488b184bfc5565b033333cd4af9e4240aa23963dd76a1b
-
SSDEEP
6144:+nhYTBI6ONsWWqOaejSlD8viNV43Km3Wlz8+5FXCnFk:2aTy6OlO3GDyYnSC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d.exe
Files
-
27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d.exe.exe windows:5 windows x86 arch:x86
aa1df04aa31b8b76e6674a21e4ac0295
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedDecrement
GetCurrentProcess
InterlockedCompareExchange
SetVolumeMountPointW
CreateHardLinkA
GetModuleHandleW
CreateNamedPipeW
EnumCalendarInfoExW
GetNumberFormatA
CreateActCtxW
TlsSetValue
LoadLibraryW
GetLocaleInfoW
GetCalendarInfoA
CreateEventA
GetFileAttributesA
GetTimeFormatW
GetModuleFileNameW
FindNextVolumeMountPointW
GetTempPathW
GetShortPathNameA
CreateJobObjectA
VerifyVersionInfoW
InterlockedExchange
GlobalUnfix
GetLogicalDriveStringsA
GetLastError
GetCurrentDirectoryW
GetProcAddress
GetLongPathNameA
PeekConsoleInputW
EnumSystemCodePagesW
GetConsoleDisplayMode
SetComputerNameA
GetCommState
GetProcessVersion
SetThreadPriorityBoost
InterlockedExchangeAdd
CreateFileMappingA
LocalAlloc
GetFileType
FoldStringW
SetEnvironmentVariableA
EnumDateFormatsA
GetProcessShutdownParameters
LoadLibraryExA
VirtualProtect
GetFileTime
WaitForDebugEvent
OpenEventW
SetFileShortNameA
GetVersionExA
GetDiskFreeSpaceExW
GetWindowsDirectoryW
LocalFree
LCMapStringW
CommConfigDialogW
CloseHandle
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
MultiByteToWideChar
WriteConsoleW
InterlockedIncrement
GetConsoleAliasExesLengthA
SetEndOfFile
GetConsoleAliasExesA
EnumCalendarInfoA
GlobalMemoryStatus
LoadModule
SetDefaultCommConfigA
SetStdHandle
FlushFileBuffers
HeapAlloc
HeapReAlloc
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
WriteFile
HeapCreate
HeapFree
TlsAlloc
TlsGetValue
TlsFree
SetLastError
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
user32
DrawStateA
SetCaretPos
LoadMenuA
CharUpperA
GetMenu
InsertMenuItemW
GetWindowLongW
GetSysColor
GetMenuStringA
gdi32
GetBkMode
GetCharWidthFloatA
CreateDCA
GetCharWidth32A
GetTextMetricsA
GetTextCharset
GetCharWidthI
winhttp
WinHttpConnect
Sections
.text Size: 211KB - Virtual size: 210KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 32.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ