Static task
static1
Behavioral task
behavioral1
Sample
2a4b3cd271002694400d45d32e8b16fca3e2eaba5f78cca0bf03c7eb7867ef66.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a4b3cd271002694400d45d32e8b16fca3e2eaba5f78cca0bf03c7eb7867ef66.exe
Resource
win10v2004-20240802-en
General
-
Target
2a4b3cd271002694400d45d32e8b16fca3e2eaba5f78cca0bf03c7eb7867ef66.bak
-
Size
920KB
-
MD5
cc91d4d0575b317fb96129f557d43488
-
SHA1
b0f44bf166216c0a807eb5cf85d3181e3c197647
-
SHA256
2a4b3cd271002694400d45d32e8b16fca3e2eaba5f78cca0bf03c7eb7867ef66
-
SHA512
58e89b204c52c8a9caa8f7cf3d64d5b9cd8c027c508c7f9dde7d6bb107dc8ab9b8e5e5563cc7919ef806021a4a6a6d830c59ad159992940dc3582222046dc70c
-
SSDEEP
24576:C/nt0V5Aku7mcJAku7mcu6rMFdnf0+nCOJ80DasEGrdDpCxYytZglecnIg4jfxa/:0t0V5Aku7mcJAku7mczo3nf0+nCOJ80H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a4b3cd271002694400d45d32e8b16fca3e2eaba5f78cca0bf03c7eb7867ef66.bak
Files
-
2a4b3cd271002694400d45d32e8b16fca3e2eaba5f78cca0bf03c7eb7867ef66.bak.exe windows:5 windows x86 arch:x86
2e9ccc15b830f2e81da9d4e900d7531b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
FindFirstFileA
GetCurrentProcessId
CreateNamedPipeA
IsValidLanguageGroup
IsValidCodePage
GetModuleHandleA
GetFileType
GetConsoleCP
IsProcessorFeaturePresent
OpenFileMappingA
MoveFileA
GetLogicalDrives
GetSystemDefaultLangID
GetConsoleWindow
FindAtomA
GetCurrentThread
GetOEMCP
IsValidLocale
IsDebuggerPresent
GetTickCount
GetProcessId
CreateWaitableTimerA
CreateTimerQueue
GetUserDefaultLCID
CreateMutexA
OpenMutexA
LoadLibraryA
GetProcessHeap
GetProcessVersion
OpenThread
DeleteFileA
OpenProcess
GetUserDefaultLangID
GetThreadLocale
GetFileAttributesA
LoadLibraryExA
GetSystemDefaultLCID
RemoveDirectoryA
MoveFileExA
GetFileSize
GetCurrentThreadId
MulDiv
GetSystemDefaultUILanguage
CreateEventA
GetDriveTypeA
CreateSemaphoreA
OpenEventA
GetConsoleAliasExesLengthA
GetProfileIntA
GetVersion
GetUserDefaultUILanguage
GlobalFindAtomA
GetCurrentProcess
CreateFileW
WriteConsoleW
SetEndOfFile
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
VirtualAlloc
lstrlenA
MultiByteToWideChar
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
FreeLibrary
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
GetLastError
HeapFree
VirtualProtect
GetSystemInfo
VirtualQuery
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
HeapSize
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetFilePointer
ReadFile
CloseHandle
GetCPInfo
GetACP
LCMapStringW
HeapReAlloc
LoadLibraryW
CreateFileA
SetStdHandle
GetConsoleMode
FlushFileBuffers
GetStringTypeW
user32
GetDC
MessageBoxW
shlwapi
StrCmpW
Sections
.text Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ