Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
b9dceded62a419c781a70e7ae784c1b928f079cfb1a266ee6bbf8759f5e38ad7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b9dceded62a419c781a70e7ae784c1b928f079cfb1a266ee6bbf8759f5e38ad7.exe
Resource
win10v2004-20241007-en
General
-
Target
b9dceded62a419c781a70e7ae784c1b928f079cfb1a266ee6bbf8759f5e38ad7.exe
-
Size
123KB
-
MD5
6048219308d660052bab10ee1f1e4728
-
SHA1
6e36ba3c585d8a389474b9ce8e2b9ebf902cad87
-
SHA256
b9dceded62a419c781a70e7ae784c1b928f079cfb1a266ee6bbf8759f5e38ad7
-
SHA512
abdd3c4e196e54d5288d1d46ce784bf4dd1763ee77a45154b3e6708d998503a7c981676c7381b2f6785722ea775eed9e69af37d61fec5df6740761b3f3dbf171
-
SSDEEP
1536:sny2nhXyqqdc5NI5Wn1tBTz2gWG2nzLAZq2nRB37vXzebVhaWXOxRWYlytgYA:sbjqdWI5k1tBNTwz52nR1Deb3bdZtgYA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9dceded62a419c781a70e7ae784c1b928f079cfb1a266ee6bbf8759f5e38ad7.exe
Files
-
b9dceded62a419c781a70e7ae784c1b928f079cfb1a266ee6bbf8759f5e38ad7.exe.exe windows:5 windows x86 arch:x86
41caf7f4ade35ce0cb6b38cca9aed7d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetProcessHeap
GetCurrentThread
FindAtomA
CreateEventW
ResumeThread
TlsGetValue
LoadLibraryW
GetProcessVersion
CreateEventW
GetDriveTypeA
lstrlenA
VirtualProtect
HeapFree
CreateEventW
GetPrivateProfileIntW
SetLastError
GetPrivateProfileSectionA
GetVolumePathNameA
DeleteFileA
GetStringTypeW
SuspendThread
clbcatq
ComPlusMigrate
DllGetClassObject
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
CheckMemoryGates
CheckMemoryGates
SetupOpen
SetupOpen
CheckMemoryGates
ComPlusMigrate
DllGetClassObject
SetupOpen
d3dramp
g_RampOld_BeadTbl
RampOldTri
RampOldTri
g_RampOld_BeadTbl
Sections
.text Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 11KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 455B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE