Static task
static1
Behavioral task
behavioral1
Sample
6b7b0d380f8c300f8fb581d9e3c7b9b9b6749a4dd764d4665477f801f1e74a81.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6b7b0d380f8c300f8fb581d9e3c7b9b9b6749a4dd764d4665477f801f1e74a81.exe
Resource
win10v2004-20240802-en
General
-
Target
6b7b0d380f8c300f8fb581d9e3c7b9b9b6749a4dd764d4665477f801f1e74a81
-
Size
2.0MB
-
MD5
7193a63c602a3dc904415b5e56677270
-
SHA1
78a1245e8bb6071dceaeecc7793f0830ce89e6fd
-
SHA256
6b7b0d380f8c300f8fb581d9e3c7b9b9b6749a4dd764d4665477f801f1e74a81
-
SHA512
609be3bb78f42efd9fee4772517907ace86d8bb8a611cf14bd845b8a443236589205087a6efe3366f5df1471b3de2871f3b945d0753c2121b7ba26e75f8900c9
-
SSDEEP
24576:EBxcqhG/e37rZ83+zdToZJoAOM08/85RkptVIJqnsqjnhMgeiCl7G0nehbGZpbD:0gi7tbYOMjUfkptVx7Dmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b7b0d380f8c300f8fb581d9e3c7b9b9b6749a4dd764d4665477f801f1e74a81
Files
-
6b7b0d380f8c300f8fb581d9e3c7b9b9b6749a4dd764d4665477f801f1e74a81.exe windows:6 windows x64 arch:x64
8b4f04d2d9e704a8f296770909ee197e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ole32
StringFromGUID2
IIDFromString
shell32
SHGetFolderPathW
CommandLineToArgvW
user32
MessageBoxW
kernel32
FindClose
GetFileAttributesA
CloseHandle
SetLastError
GetCommandLineW
GetTempPathA
GetCurrentProcess
GetSystemDirectoryA
GetNativeSystemInfo
GetModuleFileNameA
GetModuleHandleExW
LocalFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FormatMessageW
ReadFile
PeekNamedPipe
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetProcessId
WideCharToMultiByte
GetModuleHandleExA
FreeLibrary
GetProcAddress
LoadLibraryW
LoadLibraryExW
OpenMutexA
OpenProcess
LoadResource
LockResource
SizeofResource
FindResourceA
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileW
SetFilePointerEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
InitializeCriticalSectionEx
EncodePointer
LCMapStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
TlsAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
DecodePointer
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
ReadConsoleW
GetCurrentDirectoryW
HeapReAlloc
GetTimeZoneInformation
HeapSize
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
MultiByteToWideChar
RtlUnwindEx
RtlPcToFileHeader
InitializeSListHead
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
ExitProcess
SetStdHandle
CreateDirectoryW
GetFullPathNameW
WriteConsoleW
GetModuleFileNameW
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
SetEndOfFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileType
GetFileInformationByHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
GetSystemTimeAsFileTime
GetDriveTypeW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
version
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA
msi
ord137
ord8
ord67
ord91
ord189
ord204
ord115
ord117
ord31
ord159
ord160
ord168
ord44
ord141
Sections
.text Size: 446KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 154KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 800KB - Virtual size: 799KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE