Static task
static1
Behavioral task
behavioral1
Sample
40c18a1f557f4295b03c4804154e4881.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
40c18a1f557f4295b03c4804154e4881.exe
Resource
win10v2004-20231215-en
General
-
Target
40c18a1f557f4295b03c4804154e4881
-
Size
423KB
-
MD5
40c18a1f557f4295b03c4804154e4881
-
SHA1
45f83247a030522da21f7c5cacaaf7c41b356711
-
SHA256
c6e97f5f26081db3bd02f0f2fce7fecfe3da68f1dd40cedd8c497f1386f87b20
-
SHA512
002dcf4c0362844c71c8e9f063b471a9b5ac77a0eb1fe65533cac772e7b19a2c435be7e4730e5d1165bd4e9fe583ba21224c3788abb597065bba0dbfef7c9b85
-
SSDEEP
12288:m5OJEQaQIcpOHOBJuLCVRgNO4brZvuXv08+LkvyD:6xNkJuLCVe7B3DLt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40c18a1f557f4295b03c4804154e4881
Files
-
40c18a1f557f4295b03c4804154e4881.exe windows:4 windows x86 arch:x86
d03672697703b4af22632fd87f4a7f5f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
CompareStringW
HeapDestroy
FillConsoleOutputAttribute
RtlUnwind
GetModuleHandleW
GlobalReAlloc
GetCurrentProcess
GetFileType
VirtualAlloc
InitializeCriticalSectionAndSpinCount
WriteFile
HeapReAlloc
GetConsoleOutputCP
GetCurrencyFormatW
GetConsoleMode
EnumSystemLocalesA
TlsAlloc
GetModuleFileNameA
FreeEnvironmentStringsW
UnhandledExceptionFilter
Sleep
GetCPInfo
GetLocaleInfoW
SetStdHandle
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
GetLastError
EnterCriticalSection
GetStringTypeA
QueryPerformanceCounter
OutputDebugStringA
IsValidCodePage
TlsFree
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
GetDateFormatA
HeapFree
GetTimeFormatW
SetHandleCount
GetCurrentProcessId
ReadFileEx
GetOEMCP
SetLastError
LCMapStringA
GetStdHandle
DebugBreak
GetCommandLineW
GetProcessHeap
FlushFileBuffers
SetConsoleCtrlHandler
WideCharToMultiByte
FillConsoleOutputCharacterA
CloseHandle
SetFilePointer
SetEnvironmentVariableA
RaiseException
MoveFileW
WaitForSingleObject
WriteConsoleA
SetUnhandledExceptionFilter
GetProfileIntW
CreateFileA
GetStartupInfoW
GetProcAddress
GetConsoleCP
GetCurrentThread
CompareStringA
HeapCreate
InterlockedExchange
TlsGetValue
OutputDebugStringW
GetEnvironmentStringsW
VirtualQuery
LoadLibraryW
LCMapStringW
SetLocalTime
HeapSize
GetCurrentThreadId
GetTimeFormatA
MultiByteToWideChar
TerminateProcess
GetACP
GetTimeZoneInformation
GlobalAddAtomA
TlsSetValue
InterlockedDecrement
GetLocaleInfoA
GetStartupInfoA
IsDebuggerPresent
ExitProcess
HeapValidate
VirtualFree
lstrlenA
GetModuleHandleA
GetModuleFileNameW
GlobalGetAtomNameW
IsValidLocale
InterlockedIncrement
IsBadReadPtr
GetUserDefaultLCID
GetStringTypeW
comdlg32
ReplaceTextW
FindTextA
advapi32
CryptHashSessionKey
CryptGetKeyParam
CreateServiceA
LookupPrivilegeValueA
RegOpenKeyExW
LookupSecurityDescriptorPartsW
RegSaveKeyW
RegSaveKeyA
CryptAcquireContextW
RegRestoreKeyA
ReportEventW
RegSetValueExA
CryptSetProviderExA
RegQueryValueA
CryptSignHashA
LookupPrivilegeDisplayNameW
LookupPrivilegeDisplayNameA
RegRestoreKeyW
RegQueryValueW
InitiateSystemShutdownW
CryptSignHashW
CryptGetUserKey
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ