Static task
static1
Behavioral task
behavioral1
Sample
44967f1eadad3926649f39c8647b88f2b6c7cde164116a4e442f7fb799a31e9c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
44967f1eadad3926649f39c8647b88f2b6c7cde164116a4e442f7fb799a31e9c.exe
Resource
win10v2004-20231222-en
General
-
Target
44967f1eadad3926649f39c8647b88f2b6c7cde164116a4e442f7fb799a31e9c
-
Size
2.5MB
-
MD5
727ca8c187f9e5957ab259986cf25653
-
SHA1
e6154a15cc36701f7a8babbccc8150ad97d9ffcf
-
SHA256
44967f1eadad3926649f39c8647b88f2b6c7cde164116a4e442f7fb799a31e9c
-
SHA512
ceb0ab308887114c8c14c917cee174ae04223d075dfaf8f2c212db50e4643bb0d17d827bade62d1810fdf6572b642dbe84d1bf2972c6869fd2ca32640a68250c
-
SSDEEP
49152:yfccVQLHfTBHvP5az4JVn8+uhZTGVHY9yonfgNL4ylBOG2xo:JXLbBHvRq2HuDTWYPnfAPlBOG+o
Malware Config
Signatures
Files
-
44967f1eadad3926649f39c8647b88f2b6c7cde164116a4e442f7fb799a31e9c.exe windows:6 windows x86 arch:x86
2c3ef53572b50456c5fe8e1ae2d88e6a
Code Sign
3b:21:71:6e:51:33:9e:be:4d:e0:3c:67:ec:c3:1c:c0Certificate
IssuerCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/12/2023, 19:19Not After31/12/2039, 23:59SubjectCN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=UScc:40:a1:3a:29:5c:cb:0e:58:ef:4c:40:8f:3c:25:6e:4a:e7:95:d5Signer
Actual PE Digestcc:40:a1:3a:29:5c:cb:0e:58:ef:4c:40:8f:3c:25:6e:4a:e7:95:d5Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundW
imm32
ImmReleaseContext
gdiplus
GdipCloneImage
oleacc
CreateStdAccessibleObject
rpcrt4
UuidFromStringA
urlmon
URLDownloadToFileA
oleaut32
SysAllocStringLen
ole32
CoInitialize
uxtheme
GetCurrentThemeName
shlwapi
StrFormatKBSizeW
shell32
SHGetDesktopFolder
winspool.drv
ClosePrinter
msimg32
TransparentBlt
gdi32
CopyMetaFileW
user32
UnpackDDElParam
kernel32
InitializeSListHead
advapi32
RegCloseKey
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.giats Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vdata Size: - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ