Static task
static1
Behavioral task
behavioral1
Sample
e45a142539ad8f67d140f20e75c84ca947f20ce520cd4dfe9548704080995808.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
e45a142539ad8f67d140f20e75c84ca947f20ce520cd4dfe9548704080995808.exe
Resource
win10v2004-20230703-en
General
-
Target
e45a142539ad8f67d140f20e75c84ca947f20ce520cd4dfe9548704080995808
-
Size
1.0MB
-
MD5
6bca549e8890f855cf8c7f0c6f80690e
-
SHA1
e78c6c891ccbd6991753cf5eebe19641673955cc
-
SHA256
e45a142539ad8f67d140f20e75c84ca947f20ce520cd4dfe9548704080995808
-
SHA512
fe6e5ad0d3bb6b46a5462f58c4e475518ff47cf578c4f1619924c987bf99d45820b063f3aff05f3d435986f002d9da8db6cbef01204f74b2b858f0347dc159fc
-
SSDEEP
12288:tHQLUzdcNzH/2ZMhoLPJDz/ataZBdCo8K5WpYXgRWeu5NcSC1iAZ+V9Y6I9Qb6+T:KLUxmOT/4VzG1CjZ+nY6I9Qb6+sW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e45a142539ad8f67d140f20e75c84ca947f20ce520cd4dfe9548704080995808
Files
-
e45a142539ad8f67d140f20e75c84ca947f20ce520cd4dfe9548704080995808.exe windows x86
69966026cdd90468f133c4c0999015c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LoadResource
SizeofResource
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
LoadLibraryW
QueryDosDeviceW
GetEnvironmentVariableW
WaitForMultipleObjects
VirtualQuery
GetUserDefaultLangID
CreateMutexW
HeapAlloc
LocalFree
GetCurrentProcessId
GetProcessHeap
ReadConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetErrorMode
GetLastError
RaiseException
DecodePointer
WriteConsoleW
GetLogicalDriveStringsW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
GetVersionExW
LockResource
GetSystemInfo
WaitForSingleObject
ResumeThread
OpenEventW
CreateEventW
Sleep
SetEvent
ResetEvent
SearchPathW
GetDriveTypeW
ExpandEnvironmentStringsW
GetFileAttributesW
LoadLibraryA
GetVolumeInformationW
GetDiskFreeSpaceW
FindFirstFileW
GetLongPathNameW
GetShortPathNameW
CreateFileW
GetFileAttributesExW
TryEnterCriticalSection
InitializeCriticalSection
InterlockedExchangeAdd
HeapFree
GetComputerNameExW
OpenProcess
GlobalAlloc
GlobalFree
FindNextFileW
FindClose
lstrlenW
lstrcatW
lstrcpyW
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
DeleteFileW
GetFileSizeEx
GetCurrentProcess
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
GetACP
WideCharToMultiByte
SetFileTime
GetFileSize
GetFileTime
CreateDirectoryW
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
GetSystemDirectoryW
SetFileAttributesW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetCurrentDirectoryW
MoveFileExW
CopyFileW
GetTempFileNameW
MoveFileW
CreateProcessW
GetExitCodeProcess
ReleaseMutex
OpenMutexW
FormatMessageW
DeviceIoControl
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStdHandle
GetFileType
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
SetConsoleCtrlHandler
GetCurrentThread
HeapSize
HeapReAlloc
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExA
FindFirstFileExW
FindNextFileA
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
UnregisterClassW
GetMessageW
CharNextW
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
advapi32
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
oleaut32
SysFreeString
VarUI4FromStr
Sections
.text Size: 862KB - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ