Static task
static1
Behavioral task
behavioral1
Sample
3af198b560b242e0ff66a5664a5b458860a82e3296b18294b7f9a792cf517446N.exe
Resource
win7-20240903-en
General
-
Target
3af198b560b242e0ff66a5664a5b458860a82e3296b18294b7f9a792cf517446N.exe
-
Size
248KB
-
MD5
cc91a59c4a4421e3a5095a2f53bb0800
-
SHA1
90d92e432bf883b74ea61d497f7b79d937b6b185
-
SHA256
3af198b560b242e0ff66a5664a5b458860a82e3296b18294b7f9a792cf517446
-
SHA512
de36802e677aaccffbb1376197cd01ad77e41b27b2428ecdcb230b530233a85bcd35285157a80eb7ab887cc32510c1c5aecfd0b9f6e407020986594703f729c8
-
SSDEEP
6144:A/SsnH2aXBw7g723Dh5QrBl08hY/7AKrSVgHKEQTu8:Xa172t5AMUmNqEKu8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3af198b560b242e0ff66a5664a5b458860a82e3296b18294b7f9a792cf517446N.exe
Files
-
3af198b560b242e0ff66a5664a5b458860a82e3296b18294b7f9a792cf517446N.exe.exe windows:4 windows x86 arch:x86
f39b3221552433fcd9d5f0c4e850bdc9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord6336
ord2510
ord2542
ord5243
ord5740
ord1746
ord5577
ord3172
ord5653
ord4420
ord4858
ord4823
ord2399
ord4387
ord3454
ord3198
ord6080
ord6175
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3365
ord3830
ord3831
ord3825
ord3079
ord4080
ord4623
ord4426
ord3606
ord338
ord652
ord5651
ord3127
ord3616
ord2652
ord1969
ord1669
ord350
ord3663
ord1871
ord2614
ord5220
ord802
ord542
ord296
ord617
ord1085
ord5823
ord3664
ord696
ord697
ord3065
ord2761
ord1081
ord4185
ord4186
ord5597
ord415
ord910
ord909
ord395
ord394
ord2971
ord5759
ord5756
ord4330
ord5873
ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3739
ord816
ord6189
ord6186
ord6192
ord6194
ord5875
ord6172
ord6021
ord562
ord1158
ord5641
ord5450
ord6400
ord6394
ord5440
ord1825
ord2841
ord2448
ord2044
ord2107
ord3903
ord5834
ord1271
ord5605
ord996
ord2775
ord5856
ord603
ord273
ord3058
ord4696
ord5773
ord6385
ord353
ord665
ord2825
ord2393
ord941
ord939
ord5572
ord535
ord924
ord922
ord2826
ord1168
ord2818
ord815
ord561
ord4160
ord858
ord6383
ord825
ord5460
ord6571
ord823
ord537
ord882
ord2801
ord879
ord1259
ord2740
ord540
ord1861
ord4083
ord1913
ord1944
ord1789
ord1835
ord860
ord2915
ord1147
ord715
ord800
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p__fmode
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
__set_app_type
_except_handler3
__p___initenv
__CxxFrameHandler
_mbscmp
_controlfp
__RTDynamicCast
memmove
toupper
rand
srand
_CIpow
_ftol
malloc
free
_CxxThrowException
_purecall
kernel32
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
CopyFileA
DeleteFileA
FreeLibrary
GetPrivateProfileStringA
GetTempPathA
lstrcmpA
LockResource
LoadResource
FindResourceA
GlobalHandle
GlobalFree
GlobalUnlock
lstrcpyA
MulDiv
GlobalLock
GlobalAlloc
lstrcatA
OpenFile
_lclose
_llseek
GetTempFileNameA
_lread
lstrlenA
user32
SetRectEmpty
GrayStringA
DrawTextA
TabbedTextOutA
wsprintfA
OemToCharA
LoadStringA
gdi32
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
CreateFontIndirectA
SelectObject
GetTextMetricsA
DeleteObject
CreateDCA
ExtEscape
DeleteDC
Escape
msvcirt
??6ostream@@QAEAAV0@PBD@Z
?cout@@3Vostream_withassign@@A
?cerr@@3Vostream_withassign@@A
?endl@@YAAAVostream@@AAV1@@Z
Sections
.text Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE