Static task
static1
Behavioral task
behavioral1
Sample
5c40092a5a2b0417b145a57443f3a0ebfde742d1199189164fa9ac86c95b28e8N.exe
Resource
win7-20240708-en
General
-
Target
5c40092a5a2b0417b145a57443f3a0ebfde742d1199189164fa9ac86c95b28e8N
-
Size
1.8MB
-
MD5
b1c8cab9e7496c3471417c8e5559a210
-
SHA1
24d27fe01faac495c42db83203e9dbe80e9b4df5
-
SHA256
5c40092a5a2b0417b145a57443f3a0ebfde742d1199189164fa9ac86c95b28e8
-
SHA512
49f0016e939289ba724654923b3b3d447b862926f501b5a19e4ebbe02c6c51eecc13cacf379bf9445228cee549815b5b569482dc124106008b444693da6d7c9c
-
SSDEEP
24576:DtyBOuR1wYAgwvgqKBNh2qdlJoHxjgSQrh8yAVWhdrAk+c2FUpMLn50JHmL/FILA:DEBOuRH3wYjv/TQhF8hzn2yYWJHmJILA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c40092a5a2b0417b145a57443f3a0ebfde742d1199189164fa9ac86c95b28e8N
Files
-
5c40092a5a2b0417b145a57443f3a0ebfde742d1199189164fa9ac86c95b28e8N.exe windows:4 windows x86 arch:x86
5d599116f912b5ebd797046d0a369270
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
lstrcpynA
CloseHandle
TerminateProcess
OpenProcess
GetCurrentProcessId
ReadFile
SetFilePointer
FindFirstFileA
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetVersion
lstrlenA
FindClose
GetModuleFileNameA
LoadLibraryExA
IsBadReadPtr
GetSystemInfo
VirtualAlloc
GetCurrentProcess
VirtualProtect
FreeLibrary
VirtualProtectEx
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetFileSize
GetVersionExA
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
GetStdHandle
GetFileType
GetCurrentThreadId
GetLastError
VirtualFree
user32
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
GetDesktopWindow
msvcrt
calloc
free
fgetc
fputc
__mb_cur_max
_isctype
realloc
malloc
memchr
fwrite
fflush
_setmode
ftell
fseek
fgets
abort
wcsstr
_vsnprintf
vfprintf
_iob
qsort
fprintf
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
exit
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
mktime
localtime
strrchr
strcat
fopen
fread
fclose
memset
memcmp
time
memmove
strcmp
memcpy
_pctype
_fileno
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
Sections
.text Size: 328KB - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ