Static task
static1
Behavioral task
behavioral1
Sample
44a5283234c70d3eb1461878f0cce5c1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
44a5283234c70d3eb1461878f0cce5c1.exe
Resource
win10v2004-20231215-en
General
-
Target
44a5283234c70d3eb1461878f0cce5c1
-
Size
184KB
-
MD5
44a5283234c70d3eb1461878f0cce5c1
-
SHA1
4f9918c148c64bd0e48e115b029065e4e27e5470
-
SHA256
16c3fe5850eb949175c46865b4e4968ec8ae6b2d7af3a88a6ce0283480415b5b
-
SHA512
a33606111b39d953d896e2aae849d506d014c9c3f27a6288216fa4ef2ce47be633342d8a481a467f20113ec58eac26cc5667fda6afcc537f615db1b2332dcb10
-
SSDEEP
3072:crCviOTT272eslevpTeYWprJ2GcFE8A//6BhD4hqcsjhLXVfntC:eCviQCFxvte1JhcaZH6BhvV1tC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44a5283234c70d3eb1461878f0cce5c1
Files
-
44a5283234c70d3eb1461878f0cce5c1.exe windows:4 windows x86 arch:x86
c44f8e2bf2a9931e478a4ff59a559678
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
lstrlenA
Sleep
CreateThread
CopyFileA
CreateDirectoryA
ReadFile
CreateProcessA
GetProcessHeap
SetEndOfFile
GetLocaleInfoW
CreateFileA
GetOEMCP
OutputDebugStringA
WaitForSingleObject
CloseHandle
GetVersionExA
GetModuleHandleA
GetProcAddress
OpenFile
GetSystemInfo
GetACP
LoadLibraryA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
RaiseException
HeapFree
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapReAlloc
ExitProcess
LCMapStringA
GetLastError
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringA
GetCPInfo
CompareStringW
HeapSize
WriteFile
SetFilePointer
FlushFileBuffers
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
VirtualProtect
VirtualQuery
GetTimeZoneInformation
SetEnvironmentVariableA
user32
SendMessageA
FindWindowExA
FindWindowA
IsWindowVisible
GetDesktopWindow
advapi32
RegCreateKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
Sections
.text Size: 132KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE