Static task
static1
Behavioral task
behavioral1
Sample
e3e0f123c21fe1733e7327adbb281a35898bb37ba87bdedb56aefa1c4f26c348N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e3e0f123c21fe1733e7327adbb281a35898bb37ba87bdedb56aefa1c4f26c348N.exe
Resource
win10v2004-20241007-en
General
-
Target
e3e0f123c21fe1733e7327adbb281a35898bb37ba87bdedb56aefa1c4f26c348N
-
Size
981KB
-
MD5
523cf59245edf07ff8499b0aab807350
-
SHA1
80ebc8148ce0ae2bfffca391d0d89025f5a60297
-
SHA256
e3e0f123c21fe1733e7327adbb281a35898bb37ba87bdedb56aefa1c4f26c348
-
SHA512
b30e93e0d1b486f3cc70ad3752a3642dee03dfd6df879d53177bac49b83768eb377d9a31fea0ee41dbdf531484a860e14d96a3ba1870ca4d993c9a25bcca39b5
-
SSDEEP
24576:d7FGBfZkpYxAUv0ydldnbJqSULQ56K7kbUlpvAfjBo4En3TfEDuoGik:uBfZkpZ87DkbAIfjgn3T8ioGik
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e3e0f123c21fe1733e7327adbb281a35898bb37ba87bdedb56aefa1c4f26c348N
Files
-
e3e0f123c21fe1733e7327adbb281a35898bb37ba87bdedb56aefa1c4f26c348N.exe windows:5 windows x86 arch:x86
fc0ca70f22f285018aadb517b8bd0974
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsGetValue
SetEndOfFile
UnlockFile
LockFile
GetSystemTimeAsFileTime
TlsSetValue
GetVersionExW
GetFileAttributesA
GetFileAttributesW
MultiByteToWideChar
FlushFileBuffers
LockFileEx
TlsAlloc
GetTempPathA
GetSystemTime
DeleteFileA
WTSGetActiveConsoleSessionId
GetLocalTime
OutputDebugStringA
GetDriveTypeW
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetFileSize
CreateProcessW
GetFullPathNameA
GetModuleHandleExW
LocalFree
FreeLibrary
ResumeThread
LoadLibraryW
GetCurrentProcess
GetCurrentProcessId
CreateMutexW
TerminateThread
ExitProcess
GlobalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
CreateEventW
OutputDebugStringW
SetEvent
lstrlenA
TerminateProcess
CreateFileA
SetPriorityClass
DeviceIoControl
SetEnvironmentVariableA
CompareStringW
GetFullPathNameW
GetTempPathW
SetFilePointer
WriteFile
ReadFile
DeleteFileW
CreateFileW
GetLastError
GetPrivateProfileStringA
GetModuleHandleW
GetProcAddress
CloseHandle
lstrlenW
WideCharToMultiByte
Sleep
GetTickCount
GetModuleFileNameW
CreateThread
WaitForSingleObject
GetProcessHeap
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetCPInfo
LCMapStringW
RtlUnwind
GetStdHandle
GetFileType
WriteConsoleW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
GetCommandLineW
HeapSetInformation
FindFirstFileExW
FileTimeToLocalFileTime
HeapAlloc
HeapReAlloc
user32
wsprintfW
KillTimer
MessageBoxA
GetMessageW
DispatchMessageW
SetTimer
advapi32
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountSidW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CreateProcessAsUserW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
shell32
SHGetFolderPathA
SHGetFolderPathW
ord155
SHGetPathFromIDListW
SHGetFolderLocation
ole32
CoInitializeSecurity
CoInitialize
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
shlwapi
PathFileExistsW
psapi
GetModuleFileNameExW
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
winhttp
WinHttpSendRequest
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpAddRequestHeaders
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
iphlpapi
GetAdaptersInfo
Sections
.text Size: 791KB - Virtual size: 791KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ