Static task
static1
Behavioral task
behavioral1
Sample
803041f93776ed731ef00781876dd05cacfce4117feddb8933ce16615519ddebN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
803041f93776ed731ef00781876dd05cacfce4117feddb8933ce16615519ddebN.exe
Resource
win10v2004-20240910-en
General
-
Target
803041f93776ed731ef00781876dd05cacfce4117feddb8933ce16615519ddebN
-
Size
1.0MB
-
MD5
da9ccf51188f66424da8cbce22457f00
-
SHA1
c920c64d7196edc65c98dd0fc52ec03b72aa5d24
-
SHA256
803041f93776ed731ef00781876dd05cacfce4117feddb8933ce16615519ddeb
-
SHA512
e67b34453059ba113ae0b9aa4412587e0fa1e78e9e340f4ac2b2cdc81f28001fa2eaadc3e5b98b5e392496c6619ae7315e1a76a2781901b7bb02c519c2272cc2
-
SSDEEP
24576:N8kmU4JW+0j5MzaEYsqjnhMgeiCl7G0nehbGZpbD:2jJR0j5xEEDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 803041f93776ed731ef00781876dd05cacfce4117feddb8933ce16615519ddebN
Files
-
803041f93776ed731ef00781876dd05cacfce4117feddb8933ce16615519ddebN.exe windows:6 windows x86 arch:x86
d9cfa20d398945e2c5c00171499211b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
StringFromGUID2
IIDFromString
shell32
SHGetFolderPathA
SHGetFolderPathW
user32
GetMessageA
GetMessageW
TranslateMessage
DispatchMessageA
DispatchMessageW
PeekMessageA
MsgWaitForMultipleObjectsEx
IsWindowUnicode
kernel32
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetDllDirectoryA
FileTimeToSystemTime
LocalFree
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
LoadLibraryExW
OpenMutexA
DeleteFileA
FindClose
GetFileAttributesA
RemoveDirectoryA
SetFileAttributesA
CloseHandle
SetLastError
GetCommandLineW
GetTempPathA
GetCurrentProcess
GetSystemDirectoryA
GetNativeSystemInfo
GetModuleFileNameA
GetModuleHandleExW
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FormatMessageW
ReadFile
DecodePointer
CreatePipe
PeekNamedPipe
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetModuleHandleExA
LoadResource
LockResource
SizeofResource
FindResourceA
FreeLibrary
GetProcAddress
LoadLibraryW
CreateFileW
SetFilePointerEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
IsValidLocale
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
ReadConsoleW
GetCurrentDirectoryW
HeapReAlloc
GetTimeZoneInformation
HeapSize
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
GetModuleHandleW
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
CompareStringW
HeapFree
InitializeSListHead
RtlUnwind
SetHandleInformation
HeapAlloc
GetCommandLineA
GetStdHandle
GetModuleFileNameW
ExitProcess
SetStdHandle
CreateDirectoryW
GetFullPathNameW
GetConsoleMode
GetConsoleOutputCP
WriteFile
SetEndOfFile
SystemTimeToTzSpecificLocalTime
GetFileType
GetFileInformationByHandle
GetDriveTypeW
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
TlsAlloc
advapi32
RegCreateKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
oleaut32
SysFreeString
GetErrorInfo
msi
ord168
ord67
ord189
ord31
ord141
ord160
ord158
ord91
ord117
ord115
ord137
ord159
ord8
ord44
ord204
version
GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoSizeA
Sections
.text Size: 328KB - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 584KB - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE