Static task
static1
Behavioral task
behavioral1
Sample
0e45518c4ea8a5dcb1eb903252d27760.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e45518c4ea8a5dcb1eb903252d27760.exe
Resource
win10v2004-20231215-en
General
-
Target
0e45518c4ea8a5dcb1eb903252d27760
-
Size
165KB
-
MD5
0e45518c4ea8a5dcb1eb903252d27760
-
SHA1
edb84b76bc281eff78e54f23e5554c2905278b67
-
SHA256
a6d872347a6b36d134215b7e77435028cae32a01e68df18a68443e8dc6c3a5f8
-
SHA512
b6ebed2a51606d5e3b6d2d62479e1bb58bd2c2a66e0ce5f986dfa66df654d1f4312acf2a072465d1fec933fb951abc95d9e671fa09f0dbb071fdbaf9040df9fa
-
SSDEEP
3072:w3KeUawzKOVsnSuR651Y76NXWp5dTvJAIp32/tZWmUAPKMurUHkqH2XN3Zj7Z4JW:w3IafSBK4K/pmlZWm9KSHkhXNpjlH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e45518c4ea8a5dcb1eb903252d27760
Files
-
0e45518c4ea8a5dcb1eb903252d27760.exe windows:4 windows x86 arch:x86
fa3a63ac48bb8006e1ad76b4e9c6183f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
mpr
WNetLogonNotify
WNetLogonNotify
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetLogonNotify
WNetLogonNotify
WNetCloseEnum
WNetLogonNotify
WNetSetConnectionA
WNetLogonNotify
WNetCloseEnum
WNetLogonNotify
WNetCloseEnum
WNetLogonNotify
WNetLogonNotify
WNetLogonNotify
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
kernel32
TerminateProcess
WaitForSingleObject
LoadLibraryExW
GetStartupInfoA
GetSystemTime
GetSystemTime
LoadLibraryExA
LoadLibraryExA
CreateProcessA
ReadFile
CreateProcessW
TerminateProcess
WriteProcessMemory
VirtualProtectEx
LoadLibraryExA
LoadLibraryExA
ReleaseMutex
CreateProcessA
GetSystemTime
VirtualProtectEx
GetProcAddress
LoadLibraryA
VirtualProtect
GetProfileIntA
GetBinaryTypeW
Sleep
GetStartupInfoA
VirtualProtectEx
VirtualProtect
CreateProcessA
LoadLibraryExA
GetStartupInfoA
SleepEx
GetSystemTime
CreateProcessW
ReleaseMutex
GetStartupInfoA
CreateFileA
VirtualProtect
CreateProcessW
VirtualProtectEx
GetSystemTime
GetSystemTimeAsFileTime
ReleaseMutex
LoadLibraryA
Sections
.text Size: 4KB - Virtual size: 1024KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
trj Size: 2KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
431 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.rsrc Size: 152KB - Virtual size: 151KB
IMAGE_SCN_MEM_READ