Static task
static1
Behavioral task
behavioral1
Sample
0e166d7ce5e8ed21f28588f3bdffb4d8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e166d7ce5e8ed21f28588f3bdffb4d8.exe
Resource
win10v2004-20231215-en
General
-
Target
0e166d7ce5e8ed21f28588f3bdffb4d8
-
Size
200KB
-
MD5
0e166d7ce5e8ed21f28588f3bdffb4d8
-
SHA1
6f90513690402a85e933576e22df7a22d8edfb9b
-
SHA256
c6e34fcde35863fe695532f3b450b072ccb0b3113d880b9a7fc0157b38cb4d62
-
SHA512
7ce3bbc4e1b95c70ed3aaed586a5aef13be75c5fe4fa5f38a4b6a4220da092a9acc538b34fc37051aaac745da9d651e87bea8d6c1ee39500d93e098473374f85
-
SSDEEP
3072:L3SpR2QGUgMODXDMVIYMW+UmTUY+rN73d3ajxV6ME78qJiaUA5W4Ae:biTgMODXEIYMAr73W6MEwqJiVB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e166d7ce5e8ed21f28588f3bdffb4d8
Files
-
0e166d7ce5e8ed21f28588f3bdffb4d8.exe windows:4 windows x86 arch:x86
3e6f5243b3870d14ec8fa56a2e0daa0b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
IsBadReadPtr
CompareStringA
GetModuleHandleA
GetCommandLineA
GetCommandLineW
VirtualAlloc
GetACP
GetLastError
DeleteCriticalSection
ExitThread
LoadLibraryA
GetProcAddress
ExitProcess
DeleteFileA
CloseHandle
lstrlenA
CreateThread
GetOEMCP
EnterCriticalSection
CreateFileA
LoadLibraryExA
Sleep
advapi32
RegQueryValueExA
RegEnumValueA
RegOpenKeyExA
ole32
CoReleaseMarshalData
CreateStreamOnHGlobal
CoRegisterClassObject
MkParseDisplayName
gdi32
CreateFontIndirectA
GetPaletteEntries
GetDCOrgEx
LineTo
CreatePalette
GetRgnBox
CopyEnhMetaFileA
CreateBrushIndirect
shlwapi
SHQueryValueExA
SHDeleteValueA
PathFileExistsA
SHDeleteKeyA
SHSetValueA
SHGetValueA
PathGetCharTypeA
SHStrDupA
PathIsDirectoryA
Sections
CODE Size: 168KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 651B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 836B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ