Static task
static1
Behavioral task
behavioral1
Sample
4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412.exe
Resource
win10v2004-20241007-en
General
-
Target
4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412.exe
-
Size
165KB
-
MD5
65c0c7c9fe6bc1d5296447aae6c6c14c
-
SHA1
67217e5c6859afb1b2c736625fcf8bee9ad158cc
-
SHA256
4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412
-
SHA512
2453322a835c47aa10c1c7d3005319e75c01faf972efb03de9381f9dac870849917e96ca58cdd0e1f501b3d016dbda73a12af446971b545fe9fd164d739ce264
-
SSDEEP
3072:l7v9etA6pzarOLgSua/iw6kzgm0Ip1qHlBxpN/FaV0jZB6SbFW2CT75I8Buowhvw:ljm0IpqlBxpN/Fd5bFWLT7mM7w0F3+k1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412.exe
Files
-
4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412.exe.exe windows:6 windows x86 arch:x86
5a3e246a3ed32956565b5e5430d2ed15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptStringToBinaryA
rstrtmgr
RmStartSession
RmShutdown
RmEndSession
RmRegisterResources
RmGetList
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
kernel32
FindNextVolumeW
GetDriveTypeW
ReadFile
GetFileSizeEx
SetFileTime
GetQueuedCompletionStatus
GetFileAttributesW
PostQueuedCompletionStatus
SetFileAttributesW
lstrcpyA
MoveFileExW
CreateIoCompletionPort
GetFileTime
GetCurrentProcess
TerminateProcess
WaitForMultipleObjects
lstrcpyW
OpenProcess
CreateToolhelp32Snapshot
FormatMessageW
FindNextFileW
Process32NextW
Process32FirstW
GetSystemInfo
SetFilePointerEx
LocalFree
GetCurrentProcessId
FormatMessageA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetVolumeMountPointW
CreateThread
CloseHandle
lstrcatW
Sleep
CreateFileW
WaitForSingleObject
FindClose
DeviceIoControl
WriteFile
GetTempPathW
GetACP
IsValidCodePage
FindFirstFileExW
DecodePointer
GetFileType
FindFirstVolumeW
FindFirstFileW
GetProcessHeap
HeapAlloc
lstrlenA
HeapFree
lstrcmpiW
GetLastError
GetCommandLineW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
WriteConsoleW
lstrlenW
GetTickCount64
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
CompareStringW
user32
SystemParametersInfoW
ReleaseDC
GetSystemMetrics
GetDC
DrawTextA
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
GetTextExtentPoint32A
CreateCompatibleDC
CreateFontW
DeleteDC
SetTextColor
SetBkMode
SetBkColor
DeleteObject
winspool.drv
EnumPrintersW
WritePrinter
ClosePrinter
StartPagePrinter
EndDocPrinter
StartDocPrinterW
OpenPrinterW
EndPagePrinter
advapi32
SetEntriesInAclW
QueryServiceStatusEx
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
RegOpenKeyW
SetNamedSecurityInfoW
ControlService
EnumDependentServicesW
RegSetValueExW
OpenProcessToken
FreeSid
EnumServicesStatusExW
OpenServiceW
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
Sections
.text Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ