Static task
static1
Behavioral task
behavioral1
Sample
ddea2e8fdf71f225d8edebe0034e589f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ddea2e8fdf71f225d8edebe0034e589f.exe
Resource
win10v2004-20241007-en
General
-
Target
ddea2e8fdf71f225d8edebe0034e589f.exe
-
Size
421KB
-
MD5
ddea2e8fdf71f225d8edebe0034e589f
-
SHA1
b8c92917f1fe79d3595c7cdcd4c157eae69c7ba6
-
SHA256
5e76223b4ec53240790dbdb1a2937774f48094711ee0cf2a5906ffd8e727e519
-
SHA512
a924639de2b707d8e1aba9b7b5c1b2aa0cccb6e5e03513724cc0dd3049ebdc295d09b655f3fdb2c920de15a3847df99ded5e4a241af22d42ef43d61c88e3cb7e
-
SSDEEP
6144:C9L6WkBljkkvOqysCusnDXebpcOB3FyxMfb9ObhzQ5D/7sFj5:22WkBdhvOfuK+p/B3FyGbUbhQ5M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ddea2e8fdf71f225d8edebe0034e589f.exe
Files
-
ddea2e8fdf71f225d8edebe0034e589f.exe.exe windows:5 windows x86 arch:x86
1d1777ac2454d7aeb3037f82cfc93179
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleAliasExesA
CommConfigDialogA
CreateProcessW
ClearCommError
OpenJobObjectA
InterlockedDecrement
GetCurrentProcess
SetEnvironmentVariableW
CreateJobObjectW
SetComputerNameW
GetTickCount
GetNumberFormatA
GetCurrencyFormatA
EnumTimeFormatsA
GetEnvironmentStrings
SetFileShortNameW
LoadLibraryW
GetLocaleInfoW
ReadConsoleInputA
SetVolumeMountPointA
GetVersionExW
GetFileAttributesA
GetTimeFormatW
CreateSemaphoreA
GetModuleFileNameW
CreateActCtxA
GetShortPathNameA
TlsGetValue
InterlockedExchange
GetLogicalDriveStringsA
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
VirtualAlloc
CreateNamedPipeA
DefineDosDeviceA
GlobalFree
GetTempFileNameA
LoadLibraryA
InterlockedExchangeAdd
GetNumberFormatW
OpenEventA
GetCommMask
GetModuleFileNameA
EnumDateFormatsA
GlobalUnWire
GetShortPathNameW
GetDiskFreeSpaceExA
SetFileAttributesW
LCMapStringW
GetComputerNameA
VerifyVersionInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetModuleHandleA
RaiseException
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
user32
GetAltTabInfoW
gdi32
GetCharWidthA
winhttp
WinHttpOpen
Sections
.text Size: 274KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.koroc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jok Size: 512B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bit Size: 1024B - Virtual size: 923B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ