Static task
static1
Behavioral task
behavioral1
Sample
57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77.exe
Resource
win10v2004-20241007-en
General
-
Target
57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77
-
Size
343KB
-
MD5
197ff0e492aa4975318a26ce3f9fc0ff
-
SHA1
140c1c672587b825de6ad57f0bf3ec6010fc887d
-
SHA256
57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77
-
SHA512
6bfd3dd31db4fab1252f4f446cdfaba7253c9085b285763f4e500a43e9eafa5ea516093a0c4dcfb144505c0a110f9d13120039c69331850bebe1d1f1f409fc38
-
SSDEEP
6144:QLmgCCpigVaqwU5TSocyUVyCZasZgM+VGUtm:QSddU5T5cQC9CXG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77
Files
-
57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77.exe windows:5 windows x86 arch:x86
90260dfe357d15f71bf93bd425aa2a55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameA
SetProcessAffinityMask
GetNumaNodeProcessorMask
SetDefaultCommConfigA
GetNumaProcessorNode
GetLocaleInfoA
DebugActiveProcessStop
CallNamedPipeA
UpdateResourceA
InterlockedIncrement
MoveFileExW
GetEnvironmentStringsW
Process32First
GlobalLock
GetTimeFormatA
SetCommBreak
FreeEnvironmentStringsA
GetModuleHandleW
FormatMessageA
GlobalAlloc
GetSystemWow64DirectoryW
GetConsoleAliasExesLengthW
DeleteVolumeMountPointW
GetFileAttributesA
GlobalFlags
HeapCreate
GetNamedPipeInfo
GetConsoleAliasW
SetConsoleCursorPosition
GetModuleFileNameW
GetConsoleFontSize
GetStringTypeExA
GetStartupInfoA
GetStdHandle
SetLastError
GetProcAddress
MoveFileW
VirtualAllocEx
BuildCommDCBW
SetFileApisToOEM
LoadLibraryA
UnhandledExceptionFilter
InterlockedExchangeAdd
OpenWaitableTimerW
BeginUpdateResourceA
OpenJobObjectW
SetCommMask
FindAtomA
GetOEMCP
OpenFileMappingW
GetVersionExA
ReadConsoleOutputCharacterW
LocalFileTimeToFileTime
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapSize
FreeEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA
CloseHandle
FlushFileBuffers
GetModuleHandleA
user32
LoadIconA
Sections
.text Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 39.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gakeb Size: 14KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ