Static task
static1
Behavioral task
behavioral1
Sample
99dc318f59faf2c3819008ce112dac4442ab0bcff9395e0bddacd8e0911b2304.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
99dc318f59faf2c3819008ce112dac4442ab0bcff9395e0bddacd8e0911b2304.exe
Resource
win10v2004-20240802-en
General
-
Target
99dc318f59faf2c3819008ce112dac4442ab0bcff9395e0bddacd8e0911b2304
-
Size
877KB
-
MD5
ce2be627e7ec2cf88cb246615dc04e3b
-
SHA1
baef8c6a800c18f5ee243138d2ac8a746e05dc3d
-
SHA256
99dc318f59faf2c3819008ce112dac4442ab0bcff9395e0bddacd8e0911b2304
-
SHA512
cc7e561275a3be2e9e010624e8f5a4497ea2862bff589377923a35180931b2f080787b940539b9efdf4b7bd3b1e3f7d5087193605fc87f2ac3ee480f15932c2e
-
SSDEEP
12288:LtVyx0hLwzfSqdVLYI4S27f4r4D8otmVtKzb/0uz/HW5tOo2RPOBU:2x0hLwzfPRIS27f48D8+8C/250o2FOe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99dc318f59faf2c3819008ce112dac4442ab0bcff9395e0bddacd8e0911b2304
Files
-
99dc318f59faf2c3819008ce112dac4442ab0bcff9395e0bddacd8e0911b2304.exe windows:6 windows x64 arch:x64
1d878e2886045880ff55ccfced8fd653
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlNtStatusToDosError
RtlPcToFileHeader
RtlUnwindEx
TpAllocJobNotification
NtQueryObject
NtQueryInformationProcess
RtlUnwind
winhttp
WinHttpCrackUrl
kernel32
RtlVirtualUnwind
SetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
WriteConsoleW
FindClose
HeapReAlloc
GetCurrentProcess
GetLastError
LocalFree
FormatMessageA
SearchPathA
CreateFileA
WriteFile
IsDebuggerPresent
CloseHandle
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
LoadLibraryA
LoadLibraryW
FindResourceA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateFileW
DuplicateHandle
SetEvent
CreateEventW
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
WideCharToMultiByte
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
RaiseException
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
GetACP
HeapAlloc
HeapFree
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapSize
Sections
.text Size: 487KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ