Static task
static1
Behavioral task
behavioral1
Sample
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
Resource
win10v2004-20240802-en
General
-
Target
739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485
-
Size
79KB
-
MD5
0ea94d0397aab45a58b0b964355515ed
-
SHA1
a3cc337d09edfd268a7fda70525f12f2fcd34f72
-
SHA256
739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485
-
SHA512
8e7d25a35f78668ee3f4677009411060ff0841e22289568054299072bd278503dbc9a9a744cf076d5018bfe995f4383defbcb9d89ab86ee8216c0e40b41e2474
-
SSDEEP
1536:AlvQSweoWGSvsHD3ryEFmIt2HGdZcL4a32FRB9SO5sxTJhI7zJuqhZj7/:OQesnyEKHGjETirf5s7hU4EZ//
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666
Files
-
739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485.zip
Password: infected
-
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe windows:6 windows x64 arch:x64
ad380d353776ceaab3ea64e4fe37c69c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
ShellExecuteW
CommandLineToArgvW
shlwapi
PathFindExtensionW
kernel32
GetStartupInfoW
WriteConsoleW
HeapReAlloc
HeapSize
GetCommandLineW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
GetFileAttributesExW
GetFileSize
GetVolumeInformationW
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetVolumePathNamesForVolumeNameW
CloseHandle
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
Sleep
WaitForMultipleObjects
TerminateProcess
CreateThread
CreateProcessA
OpenProcess
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetModuleFileNameA
GetModuleHandleA
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
GetCurrentProcess
ExitProcess
GetModuleHandleExW
LCMapStringW
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfA
wsprintfW
rstrtmgr
RmRegisterResources
RmEndSession
RmStartSession
RmGetList
Sections
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ