Static task
static1
Behavioral task
behavioral1
Sample
851f74479e53dce889aed62388486b3e10d9ab4553d6b3da3f46ea7dc3a159d8.exe
Resource
win7-20240903-en
General
-
Target
851f74479e53dce889aed62388486b3e10d9ab4553d6b3da3f46ea7dc3a159d8.exe
-
Size
1.0MB
-
MD5
dd90c242da414233fcecb5a055b8a440
-
SHA1
0b607944175b1099cf07fad08f7b4e3d8b5a1989
-
SHA256
851f74479e53dce889aed62388486b3e10d9ab4553d6b3da3f46ea7dc3a159d8
-
SHA512
644d6a0b6f0f4ac2b5379a1fa734d295d5393f1000ab11bbe7b92852392d0bccbb009c2987f297e1b914d76ab779d7a5f1cbb6f849c972fff1fdbcfb126d956b
-
SSDEEP
24576:sD5EsM8KxD++TI7FnrB6mb1+pn/wWdIfS1wK:sjK5++kxnrB6yWdy+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 851f74479e53dce889aed62388486b3e10d9ab4553d6b3da3f46ea7dc3a159d8.exe
Files
-
851f74479e53dce889aed62388486b3e10d9ab4553d6b3da3f46ea7dc3a159d8.exe.exe windows:6 windows x64 arch:x64
745b03eca04264c305a9b7353dc4c0c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
SetCurrentDirectoryW
Process32First
GetComputerNameW
K32GetModuleFileNameExW
OpenProcess
GetVersionExW
GetModuleFileNameW
GetLocalTime
Process32Next
GlobalMemoryStatusEx
K32EnumProcesses
GetSystemInfo
CreateToolhelp32Snapshot
ExitProcess
DeleteFileW
HeapAlloc
HeapFree
GetProcessHeap
FormatMessageA
SetLastError
OutputDebugStringA
LocalFree
HeapReAlloc
GetCurrentProcess
GetModuleHandleW
HeapDestroy
HeapCreate
GetCurrentThreadId
GetCurrentProcessId
GetFullPathNameW
GetFullPathNameA
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
SystemTimeToFileTime
QueryPerformanceCounter
WaitForSingleObject
UnlockFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetSystemTimeAsFileTime
InitializeCriticalSection
WideCharToMultiByte
GetProcAddress
FormatMessageW
GetFileAttributesA
LeaveCriticalSection
HeapValidate
Sleep
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetFileAttributesExW
DeleteCriticalSection
GetVersionExA
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
FindFirstFileW
CreateDirectoryW
CopyFileW
FindClose
FindNextFileW
GetWindowsDirectoryA
GetVolumeInformationA
CopyFileA
RemoveDirectoryW
GetWindowsDirectoryW
GetVolumeInformationW
FindFirstFileA
FindNextFileA
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
GetCommandLineW
LoadLibraryExW
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
EnumSystemLocalesEx
lstrlenA
lstrcmpA
CloseHandle
GetLastError
CreateFileW
ReadFile
WriteFile
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
CompareStringEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
ReadConsoleW
lstrcatA
FreeLibrary
lstrcpyA
LoadLibraryW
GetCurrentDirectoryW
TerminateProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
ExitThread
CreateThread
GetCPInfo
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetTimeZoneInformation
GetOEMCP
GetACP
GetFileSize
GetFileAttributesW
CreateFileA
IsValidCodePage
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetStartupInfoW
InitOnceExecuteOnce
GetFileType
GetStdHandle
GetModuleHandleExW
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionEx
GetLocaleInfoEx
RtlUnwindEx
user32
wsprintfW
GetDC
GetWindow
GetTopWindow
GetWindowTextW
GetSystemMetrics
GetWindowThreadProcessId
wsprintfA
advapi32
GetUserNameW
shlwapi
PathFindExtensionW
StrCmpIW
PathStripPathA
shell32
SHGetKnownFolderPath
ShellExecuteW
SHGetFolderPathA
SHGetFolderPathW
gdi32
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
ole32
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysAllocString
bcrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptSetProperty
crypt32
CryptStringToBinaryA
CryptUnprotectData
gdiplus
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipSaveImageToFile
GdipCloneImage
GdiplusStartup
GdipGetImageEncodersSize
msi
ord246
ord70
Sections
.text Size: 795KB - Virtual size: 794KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ