Shellex
Static task
static1
Behavioral task
behavioral1
Sample
ecb05f56049ff565d1a77351ac21374b9ba05e3cb5ecabbd113d44a254d4e642.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ecb05f56049ff565d1a77351ac21374b9ba05e3cb5ecabbd113d44a254d4e642.exe
Resource
win10v2004-20240802-en
General
-
Target
ecb05f56049ff565d1a77351ac21374b9ba05e3cb5ecabbd113d44a254d4e642.exe
-
Size
43KB
-
MD5
bf586b6af6353d3770bcee9907862711
-
SHA1
07b687ce7239ea191a9cc253d3cfd1fafec06d2b
-
SHA256
ecb05f56049ff565d1a77351ac21374b9ba05e3cb5ecabbd113d44a254d4e642
-
SHA512
897a8acfabf1b278ad2ce3f704a1e2e59fbc08dc3904785fd98e63e9aca705d1710e66727399c9eeab76f545dec3d97ae566ce33e0a103c1b0588ee4370a0e51
-
SSDEEP
768:VrgeWGJaj2b2/K6/1CSGIKPlavRzY0nEs3UgLM6KLi0z1xSFopI:ybs4K6dyNPIvRMEEgCnSipI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecb05f56049ff565d1a77351ac21374b9ba05e3cb5ecabbd113d44a254d4e642.exe
Files
-
ecb05f56049ff565d1a77351ac21374b9ba05e3cb5ecabbd113d44a254d4e642.exe.exe windows:4 windows x86 arch:x86
8428bbc7d7a645de0023d5a121be2195
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
setsockopt
sendto
socket
gethostbyname
htons
connect
send
recv
inet_ntoa
WSASocketA
htonl
gethostname
WSAGetLastError
inet_addr
WSAIoctl
select
closesocket
WSACleanup
WSAStartup
msvcrt
_stricmp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
strchr
_beginthreadex
free
realloc
strcmp
_access
strcat
strrchr
strncpy
_iob
fprintf
sprintf
printf
strcpy
time
srand
rand
atoi
_local_unwind2
_except_handler3
_CxxThrowException
memcmp
??2@YAPAXI@Z
strstr
memset
strlen
__CxxFrameHandler
_ftol
ceil
memcpy
??3@YAXPAX@Z
_strupr
_strcmpi
_controlfp
mfc42
ord540
ord800
ord6877
ord939
ord2818
ord4278
ord860
ord6663
ord858
ord535
ord922
ord924
ord926
ord4129
ord2764
ord6648
ord537
kernel32
GetDiskFreeSpaceExA
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
HeapFree
VirtualProtect
GetProcessHeap
HeapAlloc
lstrcmpiA
GetCurrentThreadId
GetFileAttributesA
DefineDosDeviceA
MoveFileExA
ExpandEnvironmentStringsA
CopyFileA
SetFileAttributesA
CreateDirectoryA
DuplicateHandle
GetCurrentProcess
GetFileSize
ReadFile
FindFirstFileA
FindClose
GetLocalTime
GlobalMemoryStatusEx
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
GetModuleFileNameA
GetVersionExA
CreateFileA
WriteFile
ExitProcess
GetCurrentProcessId
ExitThread
CreateThread
GetTickCount
CancelIo
InterlockedExchange
SetEvent
Sleep
OutputDebugStringA
ResetEvent
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
lstrcpyA
WaitForSingleObject
CloseHandle
CreateEventA
VirtualFree
GetDriveTypeA
user32
wsprintfA
GetMessageA
GetInputState
PostThreadMessageA
GetWindow
GetWindowTextA
GetClassNameA
FindWindowA
advapi32
AdjustTokenPrivileges
CloseEventLog
ClearEventLogA
StartServiceCtrlDispatcherA
OpenProcessToken
LookupPrivilegeValueA
ChangeServiceConfig2A
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenEventLogA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteExA
wininet
InternetGetConnectedState
InternetOpenUrlA
shlwapi
PathRemoveFileSpecA
Exports
Exports
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ