Static task
static1
Behavioral task
behavioral1
Sample
8c1d8e39684221eb40c4a427f6cc496c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8c1d8e39684221eb40c4a427f6cc496c.exe
Resource
win10v2004-20241007-en
General
-
Target
8c1d8e39684221eb40c4a427f6cc496c.exe
-
Size
425KB
-
MD5
8c1d8e39684221eb40c4a427f6cc496c
-
SHA1
7fed5dc7edb306f02f0fb6c44bd40ddd376a627c
-
SHA256
519bb9d83ef8b44ad7a20404c2ddf967d25f8fb1a36d28859d1cee62c7eefbb5
-
SHA512
dba74a31bd39edf9f8870849fb3973482e81f24e9bf94f877b320c65bef390891ce89c03f82a6e3419702d68b8d48b569cacfbb315036fc852ed723e15927fd4
-
SSDEEP
6144:ezNMJBjynosFTmGyOaFwBYMc7UEQxZaDFaLfojoDeTy:ezNgORZmGyOaOi7YxFDo02
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c1d8e39684221eb40c4a427f6cc496c.exe
Files
-
8c1d8e39684221eb40c4a427f6cc496c.exe.exe windows:5 windows x86 arch:x86
9eefacf83d553309fed787be341d76f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumCalendarInfoW
InterlockedDecrement
GetCurrentProcess
GetLogicalDriveStringsW
SetEnvironmentVariableW
SetVolumeMountPointW
GetTimeFormatA
GetTickCount
CreateNamedPipeW
LocalFlags
GetNumberFormatA
ClearCommBreak
GetConsoleAliasExesW
GetEnvironmentStrings
LoadLibraryW
GetLocaleInfoW
_hread
GetCalendarInfoW
SetVolumeMountPointA
GetVersionExW
EnumSystemCodePagesA
CreateSemaphoreA
GetFileAttributesW
GetModuleFileNameW
CreateActCtxA
GetShortPathNameA
CreateJobObjectA
VerifyVersionInfoW
InterlockedExchange
InterlockedIncrement
GetLastError
GetCurrentDirectoryW
GetProcAddress
CopyFileA
SetComputerNameA
SetFileAttributesA
DefineDosDeviceA
GlobalFree
FindClose
LoadLibraryA
LocalAlloc
CreateHardLinkW
GetNumberFormatW
OpenEventA
FoldStringW
SetEnvironmentVariableA
GlobalWire
GetModuleFileNameA
EnumDateFormatsA
GetShortPathNameW
SetFileShortNameA
GetDiskFreeSpaceExA
ReadConsoleInputW
DebugBreak
GetTempPathA
TlsFree
LCMapStringW
CreateProcessW
CommConfigDialogA
EnumCalendarInfoA
SetFilePointer
GetStdHandle
GetComputerNameA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
FlushFileBuffers
MultiByteToWideChar
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapReAlloc
HeapAlloc
GetStartupInfoW
RaiseException
RtlUnwind
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
Sleep
HeapSize
ExitProcess
WriteFile
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetModuleHandleA
GetConsoleCP
GetConsoleMode
gdi32
CreateDCW
GetCharWidth32A
GetCharWidthI
advapi32
ReadEventLogW
ole32
CoSuspendClassObjects
winhttp
WinHttpOpen
WinHttpSetDefaultProxyConfiguration
msimg32
AlphaBlend
Sections
.text Size: 294KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.natak Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nayi Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ