Static task
static1
Behavioral task
behavioral1
Sample
5c86632a8ef4e46497b06979b965000700a51a2e1fdcf2bed91ff9c5b963a179.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5c86632a8ef4e46497b06979b965000700a51a2e1fdcf2bed91ff9c5b963a179.exe
Resource
win10v2004-20240802-en
General
-
Target
5c86632a8ef4e46497b06979b965000700a51a2e1fdcf2bed91ff9c5b963a179.exe
-
Size
240KB
-
MD5
c108169f00ff9c5ad6fa70df9137e44a
-
SHA1
1acfe826a57cdd04016324bcadaa6c7cd273b1f7
-
SHA256
5c86632a8ef4e46497b06979b965000700a51a2e1fdcf2bed91ff9c5b963a179
-
SHA512
7702cfbb2dec4a8f9d7f7aaf3b152e9d33cd764e39d99e03273b719ea7f6b2ebae219a3d549e86a9f7b6dba15e505d22d69a4e7288834b59f7f8450a57a8f392
-
SSDEEP
3072:RLzPcSAOVRt3J2XspmXG87Fj+95LOx8pljfo0l/B3:RLzUSAMt2XyO23M0r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c86632a8ef4e46497b06979b965000700a51a2e1fdcf2bed91ff9c5b963a179.exe
Files
-
5c86632a8ef4e46497b06979b965000700a51a2e1fdcf2bed91ff9c5b963a179.exe.exe windows:5 windows x86 arch:x86
5e541f0ed19da8c67474afeab35f1a51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleAliasesLengthW
GetNumaProcessorNode
GetConsoleAliasExesLengthA
WaitForSingleObject
InterlockedCompareExchange
FreeEnvironmentStringsA
GetModuleHandleW
ReadConsoleW
FormatMessageA
SetCommState
GetEnvironmentStrings
GetVolumeInformationA
FatalAppExitW
CopyFileW
GetSystemTimeAdjustment
WriteConsoleOutputA
HeapDestroy
GetFileAttributesA
SetConsoleMode
GetBinaryTypeA
GetStdHandle
SetPriorityClass
GetProcAddress
GetLongPathNameA
BuildCommDCBW
LoadLibraryA
LocalAlloc
MoveFileA
QueryDosDeviceW
CreatePipe
GetModuleFileNameA
GetDefaultCommConfigA
GetModuleHandleA
GetCommTimeouts
FreeEnvironmentStringsW
WriteConsoleOutputAttribute
FindAtomW
CreateFileA
SetStdHandle
GetLastError
GetComputerNameA
HeapFree
HeapAlloc
Sleep
ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
CloseHandle
user32
GetFocus
advapi32
ObjectPrivilegeAuditAlarmA
Sections
.text Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 996KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ruyohel Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rihogi Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ