Static task
static1
Behavioral task
behavioral1
Sample
e2a7f3f96c3d37c121939e293c68ed5a49d9c3a0ae30e646430e7c8f04338f40.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e2a7f3f96c3d37c121939e293c68ed5a49d9c3a0ae30e646430e7c8f04338f40.exe
Resource
win10v2004-20241007-en
General
-
Target
e2a7f3f96c3d37c121939e293c68ed5a49d9c3a0ae30e646430e7c8f04338f40.exe
-
Size
218KB
-
MD5
506572dc9e0784a122652c792b6dbdc4
-
SHA1
891d36b5b100cd647d9c231ea6c36b26728ceea6
-
SHA256
e2a7f3f96c3d37c121939e293c68ed5a49d9c3a0ae30e646430e7c8f04338f40
-
SHA512
cf700aa3858e0e547562a3e41d388090d53330b6194e50729732db197bf82616e82592706a8daa5d0969d49acba548fdd869d05dad6da7151a58249291552662
-
SSDEEP
3072:LELgQvpKcUJTV5nEG2MfHdPwi548Ewv6ClhJNCA43/6o5E4CA43/6XoIE:LELgQvELJn79vTHRNvTotvT4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource e2a7f3f96c3d37c121939e293c68ed5a49d9c3a0ae30e646430e7c8f04338f40.exe
Files
-
e2a7f3f96c3d37c121939e293c68ed5a49d9c3a0ae30e646430e7c8f04338f40.exe.exe windows:5 windows x86 arch:x86
82c6c5dba11f93a82c3bf13dc3056a96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SearchPathW
GetConsoleAliasesLengthW
GetNumaProcessorNode
GetDefaultCommConfigW
GetCommState
InterlockedDecrement
QueryDosDeviceA
GetEnvironmentStringsW
InterlockedCompareExchange
GetComputerNameW
ConnectNamedPipe
GetModuleHandleW
ReadConsoleW
ReadConsoleOutputA
SetCommState
GetPriorityClass
LoadLibraryW
CopyFileW
GetConsoleAliasExesLengthW
FormatMessageW
GetSystemTimeAdjustment
DeleteVolumeMountPointW
HeapDestroy
SetConsoleMode
GetFileAttributesW
GetBinaryTypeA
GetShortPathNameA
GetLastError
GetLongPathNameW
GetProcAddress
SetStdHandle
LoadLibraryA
LocalAlloc
MoveFileA
FindAtomA
GetModuleFileNameA
FreeEnvironmentStringsW
BuildCommDCBA
FatalAppExitA
WriteConsoleOutputAttribute
ReleaseMutex
GetVolumeInformationW
HeapFree
HeapAlloc
HeapReAlloc
Sleep
ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
GetFocus
Sections
.text Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 991KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yiyaluz Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cewek Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ