Static task
static1
Behavioral task
behavioral1
Sample
ce25bbf362360611dc74b3402df986617e738c9c5b92bb5b0cb6732214a5dcc2N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce25bbf362360611dc74b3402df986617e738c9c5b92bb5b0cb6732214a5dcc2N.exe
Resource
win10v2004-20240802-en
General
-
Target
ce25bbf362360611dc74b3402df986617e738c9c5b92bb5b0cb6732214a5dcc2N
-
Size
863KB
-
MD5
f7803b044bd8a35d24f705215899b460
-
SHA1
ff16fd815a5832ee11d1ca352df92732cbd2eb03
-
SHA256
ce25bbf362360611dc74b3402df986617e738c9c5b92bb5b0cb6732214a5dcc2
-
SHA512
a35751fcfb51550bb51561f20e746cbc0a3203f7110ec270049ea2f1017b4e68d445342cf298ffd7d4323f16a58fbfa66726793680a07ea2c644cc82f1978a70
-
SSDEEP
24576:94dvwnZb6HzUlBA11n14cAWZylwG6IlUnd:9G4nZ1bklA9w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce25bbf362360611dc74b3402df986617e738c9c5b92bb5b0cb6732214a5dcc2N
Files
-
ce25bbf362360611dc74b3402df986617e738c9c5b92bb5b0cb6732214a5dcc2N.exe windows:4 windows x86 arch:x86
5568760b5658a0173cb1589dc8fe0d31
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
Heap32First
Thread32Next
GlobalReAlloc
WritePrivateProfileStringA
SetVolumeLabelA
GetConsoleCursorInfo
AreFileApisANSI
GetComputerNameA
GetStdHandle
SetFileApisToOEM
CancelIo
GenerateConsoleCtrlEvent
FreeConsole
Process32Next
lstrcat
CompareStringA
ReleaseSemaphore
lstrcmp
VirtualQueryEx
EnumCalendarInfoA
GetCPInfoExA
EraseTape
GlobalFindAtomA
PeekNamedPipe
SetConsoleOutputCP
OpenFileMappingA
GetNamedPipeHandleStateA
HeapUnlock
GetPrivateProfileStructA
GetTapeParameters
ExpandEnvironmentStringsA
SetCommBreak
SetLocalTime
GetProfileIntA
GetCurrentProcessId
FatalExit
ExitProcess
InterlockedExchange
GetCommState
TerminateThread
GetPrivateProfileIntA
CreateFiber
Module32First
GetBinaryTypeA
LocalLock
lstrlen
SetStdHandle
FindResourceA
EnumSystemLocalesA
GetProcessAffinityMask
_llseek
SetProcessShutdownParameters
QueueUserAPC
FindAtomA
ContinueDebugEvent
Heap32ListNext
EnumDateFormatsA
shlwapi
StrCSpnA
PathStripToRootA
StrFormatByteSize64A
UrlIsOpaqueA
SHRegOpenUSKeyA
UrlCombineA
SHDeleteValueA
SHRegEnumUSKeyA
StrRChrIA
UrlGetLocationA
PathAppendA
PathIsRelativeA
StrChrIA
AssocQueryStringA
StrSpnA
PathSearchAndQualifyA
StrIsIntlEqualA
PathCommonPrefixA
SHIsLowMemoryMachine
PathFindOnPathA
PathRemoveBlanksA
HashData
PathIsUNCA
PathGetDriveNumberA
SHRegCreateUSKeyA
PathIsFileSpecA
PathMakePrettyA
PathQuoteSpacesA
PathFileExistsA
SHCreateStreamWrapper
SHAutoComplete
ColorHLSToRGB
advapi32
FindFirstFreeAce
Sections
.vopo Size: 638KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rupy Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.baj Size: 19KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idmxa Size: 512B - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hcxyj Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wjqha Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jafyj Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vybo Size: 49KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nuvm Size: 124KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ