?F_TB__SNucy_j@@YG_NPAF@Z
Static task
static1
Behavioral task
behavioral1
Sample
745a80b9834577203a2a40cc6e2e9c43.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
745a80b9834577203a2a40cc6e2e9c43.exe
Resource
win10v2004-20231222-en
General
-
Target
745a80b9834577203a2a40cc6e2e9c43
-
Size
46KB
-
MD5
745a80b9834577203a2a40cc6e2e9c43
-
SHA1
5b0bc16c6f23963f6f3632fa42a0a7dd91fe0fbe
-
SHA256
681ed9880fc309a0e94d862c098ac4b3b86ef429f9e05da898ef8aac0251d0d4
-
SHA512
f369025119f91bf5abab818a1ef2b5686e6313a75eb8641a1043a99385da79f23c5acf76c26acb6bc3dbc25f8db761dda01340d504ad189c308a5b0c16162e69
-
SSDEEP
768:p0U9fwbI/jq4wAxy7bqaRCXBr+hfNzO3mxbbeBIn0jaST78ELPsA5xdOn:qLWeDA2ABShfNzO3EbbehaIYsfW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 745a80b9834577203a2a40cc6e2e9c43
Files
-
745a80b9834577203a2a40cc6e2e9c43.exe windows:5 windows x86 arch:x86
7adf2419ed2a02072d31ba274747ed96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
exit
shlwapi
PathRelativePathToA
UrlGetPartA
ntdll
memset
comctl32
CreateStatusWindowW
ImageList_GetIcon
PropertySheetA
ImageList_Read
kernel32
HeapLock
LoadResource
GetComputerNameA
GlobalDeleteAtom
lstrlenA
FlushViewOfFile
GetModuleFileNameA
GetFileType
MoveFileExW
WaitForSingleObjectEx
lstrcmpA
GetModuleHandleA
LCMapStringW
SetSystemTime
LeaveCriticalSection
GetSystemDefaultUILanguage
user32
DrawFocusRect
CascadeWindows
IsWindowVisible
SendDlgItemMessageA
MonitorFromRect
GetMenuItemRect
GetAsyncKeyState
RemovePropW
mouse_event
DefWindowProcA
InSendMessageEx
SetCursorPos
CheckDlgButton
CharLowerA
CheckMenuRadioItem
CharToOemA
InvalidateRect
GetSysColor
IsWindowUnicode
GetClassInfoExW
GetSystemMenu
MessageBoxExA
TranslateAcceleratorW
IsZoomed
InvertRect
GetParent
RegisterWindowMessageA
RegisterClassExW
SendInput
gdi32
CreateFontA
SetDIBits
UnrealizeObject
CreateCompatibleBitmap
AddFontResourceW
CreateFontIndirectW
PtVisible
GetNearestColor
GetTextColor
SetROP2
ScaleWindowExtEx
GetWindowOrgEx
comdlg32
GetSaveFileNameA
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 255B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.$debug Size: 512B - Virtual size: 115B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data1 Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data2 Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data3 Size: 512B - Virtual size: 495B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data4 Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ