Static task
static1
Behavioral task
behavioral1
Sample
16a2d760311bc72ca7cf4fff3e96882a4aad1a1e335b3307bd87edd0f85f99d9.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
16a2d760311bc72ca7cf4fff3e96882a4aad1a1e335b3307bd87edd0f85f99d9.exe
Resource
win10v2004-20241007-en
General
-
Target
16a2d760311bc72ca7cf4fff3e96882a4aad1a1e335b3307bd87edd0f85f99d9
-
Size
7.9MB
-
MD5
e8a0e199ae7d7046d33eddbfcc19b6e6
-
SHA1
4e6992fb3dfa8edddb84cdae063bf7d233b3bc2b
-
SHA256
16a2d760311bc72ca7cf4fff3e96882a4aad1a1e335b3307bd87edd0f85f99d9
-
SHA512
21718589edf25f2cbf1303573b6f1542bf827b1f0d3c0050e3676b88d66440e792b5ba07b46d1d67d1cfeccd215cd6752a5e99e9635b91ad9ff373e17176627d
-
SSDEEP
196608:DG3USdPO3FYO6/VkLvgFNhHIKFydvoXU9yRM:DGkirOmmYuKFyNk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16a2d760311bc72ca7cf4fff3e96882a4aad1a1e335b3307bd87edd0f85f99d9
Files
-
16a2d760311bc72ca7cf4fff3e96882a4aad1a1e335b3307bd87edd0f85f99d9.exe windows:6 windows x86 arch:x86
63bde4fa1eb9fa9e868812b7ea27bd73
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetViewportOrgEx
advapi32
CryptContextAddRef
shell32
SHChangeNotify
ole32
CoCreateInstance
oleaut32
CreateErrorInfo
shlwapi
SHRegGetPathW
comctl32
_TrackMouseEvent
gdiplus
GdiplusShutdown
secur32
GetUserNameExW
version
VerQueryValueW
imm32
ImmDisableIME
wtsapi32
WTSRegisterSessionNotification
WTSSendMessageW
winmm
PlaySoundW
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
crypt32
CryptBinaryToStringA
wintrust
WTHelperProvDataFromStateData
msimg32
GradientFill
urlmon
URLDownloadToCacheFileW
Sections
.text Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 670KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 7.7MB - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 221KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ