Static task
static1
Behavioral task
behavioral1
Sample
6cd1fde37084da8372a32b5a00c2ff554d32ae772d98411de4e2a8fa1817a70fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6cd1fde37084da8372a32b5a00c2ff554d32ae772d98411de4e2a8fa1817a70fN.exe
Resource
win10v2004-20240802-en
General
-
Target
6cd1fde37084da8372a32b5a00c2ff554d32ae772d98411de4e2a8fa1817a70fN
-
Size
18KB
-
MD5
fbdbee721d4be99d1af87411c661ac50
-
SHA1
172b58dcf29f8ff991910925011ca1f045b165f7
-
SHA256
6cd1fde37084da8372a32b5a00c2ff554d32ae772d98411de4e2a8fa1817a70f
-
SHA512
ec8bc35b1803217591a093dbcccf23e778667e7892a2ad9bf37484549d3e01d196cc349f51b1029ddb75a1ed8509bb22bd3997ad17b83f98df7992b2d5c35849
-
SSDEEP
384:F7swVr3G7K2X8kG3rLy1//OKWhRufIlNFSRFDJKXY74:F7hVF2ACOKgufINFUDJKoM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6cd1fde37084da8372a32b5a00c2ff554d32ae772d98411de4e2a8fa1817a70fN
Files
-
6cd1fde37084da8372a32b5a00c2ff554d32ae772d98411de4e2a8fa1817a70fN.exe .vbs windows:4 windows x86 arch:x86 polyglot
d494e4586bfdf51e0544b0c3dd2eaa2b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
OpenProcess
GetTickCount
WinExec
GetProcAddress
LoadLibraryA
GetLastError
lstrlenA
CopyFileA
GetModuleFileNameA
GetVersionExA
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetWindowsDirectoryA
ExitProcess
CreateProcessA
GetCurrentProcess
GetTempPathA
CreateThread
DeleteFileA
Sleep
ExitThread
GlobalMemoryStatus
SetFileAttributesA
lstrcpyA
user32
ExitWindowsEx
advapi32
RegDeleteKeyA
RegCreateKeyA
RegSetValueA
RegSetValueExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
msvcrt
_except_handler3
fwrite
fclose
fread
fopen
printf
sprintf
strstr
fputs
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
ws2_32
WSACleanup
WSAStartup
sendto
socket
htons
gethostbyname
inet_addr
send
recv
WSAGetLastError
setsockopt
inet_ntoa
WSASocketA
htonl
connect
closesocket
wininet
DeleteUrlCacheEntry
Sections
.data Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ