Static task
static1
Behavioral task
behavioral1
Sample
848029fcdafbb4e69fd2ba46ae0852e47ce881892044872a48fc858f5e2e40dcN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
848029fcdafbb4e69fd2ba46ae0852e47ce881892044872a48fc858f5e2e40dcN.exe
Resource
win10v2004-20240910-en
General
-
Target
848029fcdafbb4e69fd2ba46ae0852e47ce881892044872a48fc858f5e2e40dcN
-
Size
73KB
-
MD5
f9312f478522c93bd8e748ef62ae5310
-
SHA1
b6ceba6db2ee5af72726661699c1609246f3b5f3
-
SHA256
848029fcdafbb4e69fd2ba46ae0852e47ce881892044872a48fc858f5e2e40dc
-
SHA512
827877afad0ee13e3e7040c51269b0b979cfd65a202a188bb6cec7376fa53e47284c6e39874c56de14973e2fa398aa5a53dcb11457a1b23392e74efee19733f4
-
SSDEEP
1536:6PyNjTE/7V8ZANFofKr0tkRuDlLIe16VAHdY2KlQQ9mNObkJX:lNvE/hlNF4Kr0tkRuDlLIXViWvbbk5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 848029fcdafbb4e69fd2ba46ae0852e47ce881892044872a48fc858f5e2e40dcN
Files
-
848029fcdafbb4e69fd2ba46ae0852e47ce881892044872a48fc858f5e2e40dcN.exe windows:4 windows x86 arch:x86
e72c60e652b51698fad2444f24e19172
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ChangeServiceConfig2A
DeleteService
FreeSid
GetSecurityDescriptorControl
OpenSCManagerA
RegCreateKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherA
kernel32
CloseHandle
CompareStringA
ContinueDebugEvent
CreateDirectoryA
CreateMutexA
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FindClose
FindResourceA
FreeEnvironmentStringsA
FreeLibrary
GetCPInfo
GetCommandLineA
GetConsoleOutputCP
GetCurrentProcessId
GetFileType
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetTempPathA
GetThreadLocale
GetTimeZoneInformation
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsDebuggerPresent
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryExA
LocalFree
MapViewOfFile
Module32Next
OpenEventA
RaiseException
ReadFile
ReadProcessMemory
ResetEvent
SearchPathA
SetFileAttributesA
SetHandleCount
SetLastError
SetPriorityClass
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TlsAlloc
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
WaitForSingleObject
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrlenA
user32
BeginPaint
CharUpperA
CreatePopupMenu
CreateWindowExA
DrawFocusRect
EnableMenuItem
EnableWindow
EnumChildWindows
FindWindowA
GetActiveWindow
GetForegroundWindow
GetProcessWindowStation
GetSysColorBrush
GetSystemMenu
GetWindowTextA
GetWindowThreadProcessId
InflateRect
IntersectRect
IsWindowEnabled
LoadCursorA
LoadIconA
LoadStringA
MapWindowPoints
MessageBoxA
OffsetRect
PostMessageA
SendDlgItemMessageA
SetForegroundWindow
TrackPopupMenu
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 33KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
srlje Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wqasj Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ