Static task
static1
Behavioral task
behavioral1
Sample
5465c3829f0bab7e2caf1ac56efa4fc3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5465c3829f0bab7e2caf1ac56efa4fc3.exe
Resource
win10v2004-20231215-en
General
-
Target
5465c3829f0bab7e2caf1ac56efa4fc3
-
Size
128KB
-
MD5
5465c3829f0bab7e2caf1ac56efa4fc3
-
SHA1
b3d1fcea8f113e277b0abd86bf4618fb92de930d
-
SHA256
71fae4e140a7f2803e35e847a5b41067861bb1ad226d589800520a3e694cf7d6
-
SHA512
5ce778f4de3b791ac0422a0bd255dfd127746ac3b0e61163b8157690b66202c8f8034ccc007906bff560be7025a9c54bc42588cd2a2295986bbd14316cecce36
-
SSDEEP
3072:/k7Xg4lwgQrlIuP54etYlKF6nlV76kR20Wzeqs:/kjgeAlxtYsIfBws
Malware Config
Signatures
Files
-
5465c3829f0bab7e2caf1ac56efa4fc3.exe windows:5 windows x86 arch:x86
df5b27f23e3b123be0f4037dbbdcbe52
Code Sign
4a:90:32:00:73:89:00:a6:4f:38:15:9d:8e:74:3a:acCertificate
IssuerCN=Root AgencyNot Before10/11/2010, 12:18Not After31/12/2039, 23:59SubjectCN=Madam it is so you stand pleased withal0b:5d:f9:c2:31:30:2d:bc:b9:fb:1c:dc:98:a7:41:5f:74:42:b8:c5Signer
Actual PE Digest0b:5d:f9:c2:31:30:2d:bc:b9:fb:1c:dc:98:a7:41:5f:74:42:b8:c5Digest Algorithmsha1PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
lstrcpyA
FindFirstFileW
lstrcpyW
GetCurrentProcessId
GlobalDeleteAtom
CreateEventA
GetLongPathNameW
LoadLibraryExA
GetSystemTime
GetThreadTimes
GetCurrentThreadId
GetUserDefaultLCID
FindAtomW
VirtualAlloc
WaitForSingleObject
GetProcAddress
LoadLibraryA
IsBadReadPtr
VirtualProtect
VirtualFree
GetModuleHandleA
Sleep
SystemTimeToFileTime
GetCurrentThread
user32
GetDlgCtrlID
CharUpperA
GetProcessDefaultLayout
IsWindow
DestroyWindow
GetDoubleClickTime
GetMenuItemID
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
MessageBoxA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
Sections
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ