a7748f743579abf78f4317a7fed2691a131377d8062740ca9c47b766f33a1e53
- SHA256 a7748f743579abf78f4317a7fed2691a131377d8062740ca9c47b766f33a1e53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
065ac71e700c145b999d983c8da94d24784d14f6ddd4129d471fd92665a79579.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
065ac71e700c145b999d983c8da94d24784d14f6ddd4129d471fd92665a79579.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target a7748f743579abf78f4317a7fed2691a131377d8062740ca9c47b766f33a1e53
- Size 141KB
- Sample241109-decgzswcnc
- SHA256 a7748f743579abf78f4317a7fed2691a131377d8062740ca9c47b766f33a1e53
- MD5 d040c5f82de45ed9a838cac9984be5de
- SHA1 df21873551ea722b981f1b20fe503ea6f3725354
- SHA512 90bfc6ee54e9a2347e3923cf3935d292ad889aec6f138eec3b94dcdc7f907e27f31a01439dc250311f6a42be0fc0c064bfc02d6a057a74cabd9205a030e4de21
- SSDEEP 3072:PiXOPWtw52unzzFULe1zEKoj8qsuGTN8yWR1knEZl7+7b8qQlmwUvNo29U:PbPv2uVUiOjtMKfke+nfqi6
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/065ac71e700c145b999d983c8da94d24784d14f6ddd4129d471fd92665a79579
File Explorer
-
a7748f743579abf78f4317a7fed2691a131377d8062740ca9c47b766f33a1e53.zip 141KB
-
065ac71e700c145b999d983c8da94d24784d14f6ddd4129d471fd92665a79579.exe 226KB
065ac71e700c145b999d983c8da94d24784d14f6ddd4129d471fd92665a79579
- IMPHASH 20ccb1944ade4ba7446fef06e4f4523e
- SHA256 065ac71e700c145b999d983c8da94d24784d14f6ddd4129d471fd92665a79579
- MD5 6febc6df81ab3b8f32c13a2dbe232676
- SHA1 50fec1c2b794a2663bfe0c1d189391e56c4061b5
- SHA512 eeef703978d01554f5478fd07b8a5c3022e239e3c8e8be53356c19c8fd8fcb371d1a3f50a422a5bd92d30399037ddbb9b0f1ef8832191422faea19fbef587f4e
- SSDEEP 3072:cDkKLnfGH5H4YL2miAYuGxutsY/OSLkIcauDsK9jof/ln:ILn+eYCrHxgsraMnC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
15772
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\gilatifokey\kezem.pdb
kernel32
OpenMutexW
GetConsoleAliasesLengthA
SetFileApisToOEM
EnumCalendarInfoExW
RequestWakeupLatency
GetConsoleAliasW
GetModuleHandleA
CreateDirectoryExW
GetLogicalDriveStringsW
ReadConsoleInputA
FindNextVolumeMountPointW
SearchPathW
CopyFileExW
CallNamedPipeW
GetCurrentDirectoryW
GetSystemDirectoryA
CreateMailslotW
TlsGetValue
GetProcAddress
LocalAlloc
GetCommandLineW
DebugActiveProcess
GetConsoleMode
FindFirstVolumeA
LocalFree
LocalFlags
InterlockedIncrement
ExitProcess
GetCurrencyFormatW
BuildCommDCBAndTimeoutsW
CreateActCtxA
EnumDateFormatsW
GetPrivateProfileIntA
_lread
SetVolumeMountPointW
GetSystemWindowsDirectoryA
LoadModule
lstrlenW
CreateDirectoryA
GlobalFindAtomW
CopyFileW
VerSetConditionMask
CreateMutexW
DeactivateActCtx
ReadFile
MoveFileA
GetLogicalDriveStringsA
SetEvent
MoveFileExW
OpenMutexA
FindResourceW
GetConsoleFontSize
GetConsoleAliasExesLengthA
FindFirstFileA
EnumResourceLanguagesW
InterlockedCompareExchange
FreeEnvironmentStringsA
InterlockedExchangeAdd
GetModuleHandleW
GetTickCount
SetLastError
GetLogicalDrives
OpenJobObjectA
LoadLibraryA
GetLastError
WideCharToMultiByte
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
GetConsoleCP
FlushFileBuffers
RtlUnwind
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
CloseHandle
advapi32
InitiateSystemShutdownW
winhttp
WinHttpWriteData
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
75KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=96, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=139, id=1, productName=Unmarked objects,
count=29, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,