Static task
static1
Behavioral task
behavioral1
Sample
b1fbcd11fa9d9ae4ed772a8ec5fad5e61868f1ce6b44ae4705690267b0d5de1fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b1fbcd11fa9d9ae4ed772a8ec5fad5e61868f1ce6b44ae4705690267b0d5de1fN.exe
Resource
win10v2004-20240802-en
General
-
Target
b1fbcd11fa9d9ae4ed772a8ec5fad5e61868f1ce6b44ae4705690267b0d5de1fN.exe
-
Size
238KB
-
MD5
eab293cb23cd21b0ab094707c9c18900
-
SHA1
b740c9e3f9b64373943862d2e653cf153c601b73
-
SHA256
b1fbcd11fa9d9ae4ed772a8ec5fad5e61868f1ce6b44ae4705690267b0d5de1f
-
SHA512
c95251988f68508439847a2e59311cf7eb66f4576ebe7f4948f11fd4e14f72b038634d9392ef3cab431dd86bfa0e7b9c237e639a3d97d8948e2b212d0682bbde
-
SSDEEP
6144:VRuhORg5xyqn2ApNN5CGHA8PBhf+Uh3iTh+lV:Vo5YApxHA8PBhfgwV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1fbcd11fa9d9ae4ed772a8ec5fad5e61868f1ce6b44ae4705690267b0d5de1fN.exe
Files
-
b1fbcd11fa9d9ae4ed772a8ec5fad5e61868f1ce6b44ae4705690267b0d5de1fN.exe.exe windows:4 windows x86 arch:x86
1696b0b004fdea8365de92f969f82948
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
FreeLibrary
LoadLibraryExW
GetThreadLocale
SetThreadLocale
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
SetCurrentDirectoryW
CreateProcessW
GetPrivateProfileIntW
GetSystemTimeAsFileTime
FindCloseChangeNotification
CompareFileTime
WaitForSingleObject
SystemTimeToFileTime
GetLocalTime
FindFirstChangeNotificationW
GetTimeZoneInformation
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
FileTimeToSystemTime
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcmpiW
RaiseException
GetModuleHandleW
lstrlenW
DeleteCriticalSection
GetCurrentDirectoryW
CloseHandle
CreateEventW
UnhandledExceptionFilter
CreateThread
CreateFileW
GetFileSize
ReadFile
HeapSize
HeapDestroy
IsValidCodePage
VirtualAllocEx
user32
LoadStringW
CharNextW
advapi32
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
OpenThreadToken
GetTokenInformation
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCloseKey
shell32
SHGetFileInfoW
ole32
CoRevertToSelf
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoImpersonateClient
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
oleaut32
SysFreeString
VarUI4FromStr
SysAllocString
VarBstrCmp
VariantCopy
SafeArrayLock
SafeArrayUnlock
SafeArrayCreate
SafeArrayRedim
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
VarBstrCat
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
esent
JetCreateInstance
odbccr32
SQLRowCount
SQLMoreResults
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.O Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nJ Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 212KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.odmi Size: 1024B - Virtual size: 1001B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ