Static task
static1
Behavioral task
behavioral1
Sample
96cdce80844f2f83068a898557e543757604fc019485dac386b879068b2f5dc1.exe
Resource
win7-20240708-en
General
-
Target
96cdce80844f2f83068a898557e543757604fc019485dac386b879068b2f5dc1
-
Size
2.5MB
-
MD5
48d6df0ee3eaa10b4f506951fcc57803
-
SHA1
17edd1ede9ceae0d6146a95123266f35288afb96
-
SHA256
96cdce80844f2f83068a898557e543757604fc019485dac386b879068b2f5dc1
-
SHA512
01d44b534c878bc210a4b40a1737bfbda907aa87cff5658da5837bc18d1b546ef2b724543593a873fd9b6c2411256df1d488805661a2a9f535c52b562546b23b
-
SSDEEP
49152:wcARyCfxGVZI4oExCv3jCZwgQAwgQAwgQAwgQS:wcA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96cdce80844f2f83068a898557e543757604fc019485dac386b879068b2f5dc1
Files
-
96cdce80844f2f83068a898557e543757604fc019485dac386b879068b2f5dc1.exe windows:6 windows x86 arch:x86
50280c6e32cae0f69ebfdf0d78a0e4fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
SetEvent
CloseHandle
CreateEventA
GetCurrentThreadId
SetLastError
CancelIo
InterlockedExchange
lstrlenW
CreateEventW
ResetEvent
WideCharToMultiByte
ResumeThread
OpenProcess
GetFileAttributesA
GetSystemDirectoryA
GetThreadContext
VirtualAllocEx
HeapReAlloc
SetThreadContext
GetExitCodeProcess
GetFileSizeEx
WriteFile
GetModuleFileNameW
SetErrorMode
FindClose
CreateFileW
GetCurrentDirectoryA
CreateToolhelp32Snapshot
GetTickCount64
Process32NextW
CreateFileA
Process32FirstW
GetSystemInfo
LoadLibraryW
CreateThread
GetProcAddress
GetCurrentProcessId
GlobalMemoryStatusEx
FreeLibrary
CopyFileW
GetConsoleWindow
WinExec
lstrcmpiW
WriteConsoleW
ReadConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetLastError
Sleep
HeapSize
InitializeCriticalSectionAndSpinCount
VirtualAlloc
VirtualFree
CreateProcessA
HeapFree
FindNextFileW
FindFirstFileExW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
ExitProcess
GetModuleHandleExW
ExitThread
RtlUnwind
IsDebuggerPresent
OutputDebugStringW
MultiByteToWideChar
GetStringTypeW
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
EncodePointer
QueryPerformanceCounter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
user32
ShowWindow
GetCursorPos
GetInputState
PostThreadMessageA
advapi32
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegQueryValueExW
GetUserNameW
ws2_32
WSACleanup
closesocket
gethostbyname
select
WSAStartup
send
socket
connect
recv
htons
setsockopt
WSAIoctl
winmm
timeGetTime
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 454KB - Virtual size: 454KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ