Static task
static1
Behavioral task
behavioral1
Sample
4d94742425b58e30db5b6df14f052e5576fef0dcb8ef48b5546f1301a72aca0c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4d94742425b58e30db5b6df14f052e5576fef0dcb8ef48b5546f1301a72aca0c.exe
Resource
win10v2004-20241007-en
General
-
Target
4d94742425b58e30db5b6df14f052e5576fef0dcb8ef48b5546f1301a72aca0c
-
Size
343KB
-
MD5
0d8527d14f11598a794ee2f28cc19cbe
-
SHA1
a76f6e1aa1b9ef444ad25882effe119cff2fbe85
-
SHA256
4d94742425b58e30db5b6df14f052e5576fef0dcb8ef48b5546f1301a72aca0c
-
SHA512
c053c75407e4a206e879acdcc978c18d2233b1035f61e608ef55d85fe4882537d5a5911fdbc91598c8c637b43fd9f042da369138ddbb40bf35f5d59cb504c117
-
SSDEEP
6144:kLycXW4sxZ2VbSFSxBffJpQWROYvGsrZEOuvHyGYJW9E:kucXDDfJ2MO4GsdeyGYJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4d94742425b58e30db5b6df14f052e5576fef0dcb8ef48b5546f1301a72aca0c
Files
-
4d94742425b58e30db5b6df14f052e5576fef0dcb8ef48b5546f1301a72aca0c.exe windows:5 windows x86 arch:x86
90260dfe357d15f71bf93bd425aa2a55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetComputerNameA
SetProcessAffinityMask
GetNumaNodeProcessorMask
SetDefaultCommConfigA
GetNumaProcessorNode
GetLocaleInfoA
DebugActiveProcessStop
CallNamedPipeA
UpdateResourceA
InterlockedIncrement
MoveFileExW
GetEnvironmentStringsW
Process32First
GlobalLock
GetTimeFormatA
SetCommBreak
FreeEnvironmentStringsA
GetModuleHandleW
FormatMessageA
GlobalAlloc
GetSystemWow64DirectoryW
GetConsoleAliasExesLengthW
DeleteVolumeMountPointW
GetFileAttributesA
GlobalFlags
HeapCreate
GetNamedPipeInfo
GetConsoleAliasW
SetConsoleCursorPosition
GetModuleFileNameW
GetConsoleFontSize
GetStringTypeExA
GetStartupInfoA
GetStdHandle
SetLastError
GetProcAddress
MoveFileW
VirtualAllocEx
BuildCommDCBW
SetFileApisToOEM
LoadLibraryA
UnhandledExceptionFilter
InterlockedExchangeAdd
OpenWaitableTimerW
BeginUpdateResourceA
OpenJobObjectW
SetCommMask
FindAtomA
GetOEMCP
OpenFileMappingW
GetVersionExA
ReadConsoleOutputCharacterW
LocalFileTimeToFileTime
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapSize
FreeEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA
CloseHandle
FlushFileBuffers
GetModuleHandleA
user32
LoadIconA
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 39.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fusez Size: 14KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ