Static task
static1
Behavioral task
behavioral1
Sample
ed44411b013cc0df6bb6b2a2405af2bffc0027c43491ab02cc92e8d86f65a8dd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ed44411b013cc0df6bb6b2a2405af2bffc0027c43491ab02cc92e8d86f65a8dd.exe
Resource
win10v2004-20241007-en
General
-
Target
ed44411b013cc0df6bb6b2a2405af2bffc0027c43491ab02cc92e8d86f65a8dd
-
Size
552KB
-
MD5
0b70ce239fd63ff64fc4b8854dee2fe8
-
SHA1
8eaaccba38c06df1912589b09ec4d7b7711fcf49
-
SHA256
ed44411b013cc0df6bb6b2a2405af2bffc0027c43491ab02cc92e8d86f65a8dd
-
SHA512
9d38f765795b03ffddb02188815ad9a8ec9c6ac2cc46e36b2d6982193c567466347306e4d0cf1231443a2d4f8ae14be20d84904fa073d5de1eb96806f3207884
-
SSDEEP
12288:EaHO8XwpZEj4HcQWoVqZ4pFRw3/MD1pTLNu:EaHlXaKNDhmpuUnNu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ed44411b013cc0df6bb6b2a2405af2bffc0027c43491ab02cc92e8d86f65a8dd
Files
-
ed44411b013cc0df6bb6b2a2405af2bffc0027c43491ab02cc92e8d86f65a8dd.exe windows:5 windows x86 arch:x86
fcfd172762d94cac70e138bbe1ff2df6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessAffinityMask
SetDefaultCommConfigA
GetNumaProcessorNode
GetLocaleInfoA
DebugActiveProcessStop
CallNamedPipeA
InterlockedIncrement
MoveFileExW
GetEnvironmentStringsW
Process32First
GlobalLock
GetTimeFormatA
SetCommBreak
FreeEnvironmentStringsA
GetModuleHandleW
FormatMessageA
GlobalAlloc
GetSystemWow64DirectoryW
GetConsoleAliasExesLengthW
DeleteVolumeMountPointW
GlobalFlags
HeapCreate
GetNamedPipeInfo
GetConsoleAliasW
SetConsoleCursorPosition
GetFileAttributesW
GetModuleFileNameW
GetConsoleFontSize
GetStringTypeExA
GetStartupInfoA
GetStdHandle
SetLastError
GetProcAddress
SetVolumeLabelW
VirtualAllocEx
BuildCommDCBW
LoadLibraryA
InterlockedExchangeAdd
OpenWaitableTimerW
MoveFileA
SetCommMask
FindAtomA
GetOEMCP
GetModuleHandleA
OpenFileMappingW
GetVersionExA
ReadConsoleOutputCharacterW
LocalFileTimeToFileTime
CloseHandle
WriteConsoleW
MultiByteToWideChar
HeapAlloc
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedDecrement
GetACP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
HeapSize
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
Sections
.text Size: 452KB - Virtual size: 451KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 39.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ