Static task
static1
Behavioral task
behavioral1
Sample
b08f460456e8e321f788b9a77f7b3071f9215ed7004d49f81ce64e3563c11b29.exe
Resource
win7-20240508-en
General
-
Target
b08f460456e8e321f788b9a77f7b3071f9215ed7004d49f81ce64e3563c11b29
-
Size
1.4MB
-
MD5
c0c15d9373e475d85af4ba550dcf6f06
-
SHA1
792ba733083a47aab466003a9c132670850e600e
-
SHA256
b08f460456e8e321f788b9a77f7b3071f9215ed7004d49f81ce64e3563c11b29
-
SHA512
66d1090cef32632b0dc156e8781660f430cf13cd5de2164fe69dd19bfd60c50d0e76b50fef801075a02535fd0096aba470ba1364ce558780fc02142dae161e79
-
SSDEEP
24576:0C2X+9j9h+YJpAUBAUZLY5ywGKH3Gavkg3NyElQhbbToKuHfg1f9mydcdVWqwq:pP9j9X5BAUZLY5/fH3GaXDQuKuHQvch
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b08f460456e8e321f788b9a77f7b3071f9215ed7004d49f81ce64e3563c11b29
Files
-
b08f460456e8e321f788b9a77f7b3071f9215ed7004d49f81ce64e3563c11b29.exe windows:4 windows x86 arch:x86
3b3c0923bec0fa834f2632937141eb77
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateEventA
CreateFileA
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetACP
GetCurrentThreadId
GetExitCodeProcess
GetFullPathNameA
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTempPathA
GetThreadLocale
GetVersionExA
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
SetEvent
SetHandleInformation
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_close
_fdopen
_fstat
_getcwd
_getpid
_open
_putenv
_read
_stat
_strdup
_unlink
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_access
_cexit
_close
_dup
_errno
_flsbuf
_get_osfhandle
_iob
_isctype
_onexit
_open
_pctype
_pipe
_read
_setmode
_snprintf
_snwprintf
_stricmp
_vsnprintf
_vsnwprintf
_winmajor
abort
atexit
bsearch
calloc
exit
fclose
fflush
fgetc
fgets
fopen
fprintf
fputc
fputs
fputwc
fread
free
freopen
fseek
ftell
fwrite
getenv
localeconv
malloc
memcmp
memcpy
memmove
qsort
raise
realloc
remove
setlocale
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strstr
strtoul
tolower
vfprintf
vfwprintf
wcschr
wcslen
user32
CharLowerBuffA
Sections
.text Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1006KB - Virtual size: 1006KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eadttpy Size: 84KB - Virtual size: 84KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE