Static task
static1
Behavioral task
behavioral1
Sample
45e18c4a64d02d99156dc3a75603a240.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
45e18c4a64d02d99156dc3a75603a240.exe
Resource
win10v2004-20231215-en
General
-
Target
45e18c4a64d02d99156dc3a75603a240
-
Size
30KB
-
MD5
45e18c4a64d02d99156dc3a75603a240
-
SHA1
549d6879208795db03f7e268ba2cf4bfb881b45c
-
SHA256
f002e84df7f3906d363522b3e4497f9f5ed37b996fcc862dede912d2b7386d5b
-
SHA512
d29fee8bd9dee184427c6d7c9aca6a7a2bac8d52a37475825cfbbcd13c07563539d2451246e3b8547cde4b56d8100121e8eeb4424f509077bcca8e4117cdee53
-
SSDEEP
768:fEUlIyjTLkR5IV6PPgzoytLlQ4R1ucbyVZR:BGygQoygsByF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45e18c4a64d02d99156dc3a75603a240
Files
-
45e18c4a64d02d99156dc3a75603a240.exe windows:4 windows x86 arch:x86
2f54fe08b2109ea4f2fca4d7b82cf347
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
DeleteFileA
CloseHandle
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetLastError
ExitThread
lstrcatA
CreateEventA
Sleep
WaitForSingleObject
HeapAlloc
HeapFree
GetProcessHeap
ReadFile
ExitProcess
SetEvent
CreateThread
WriteFile
LoadResource
FindResourceA
CompareStringA
Process32First
CreateToolhelp32Snapshot
lstrlenA
lstrcmpA
WaitForMultipleObjects
ResetEvent
FreeLibrary
CreateFileA
PulseEvent
RtlUnwind
user32
CreateWindowExA
DestroyWindow
PeekMessageA
TranslateMessage
MsgWaitForMultipleObjects
DispatchMessageA
wsprintfA
AnyPopup
advapi32
RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegNotifyChangeKeyValue
ole32
CoInitialize
CoUninitialize
shell32
SHGetFolderPathA
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ