Static task
static1
Behavioral task
behavioral1
Sample
45575a23a576575d3682c59b6d351a0e25c4931bcea538467529983108919fcb.exe
Resource
win7-20240419-en
General
-
Target
45575a23a576575d3682c59b6d351a0e25c4931bcea538467529983108919fcb
-
Size
15.6MB
-
MD5
bf650cd91cd79bbcf78f110c63d22840
-
SHA1
8939370a11fded35b3e4f76342a680d6cd27d2ac
-
SHA256
45575a23a576575d3682c59b6d351a0e25c4931bcea538467529983108919fcb
-
SHA512
52e886442e46b9a6e22fff6e8920f94f047a49ecdc2a7e122fbaaa14f4a4e6b8122ff5c7ef7407d3536607149e58c692b5902d795d0ce188716b335210c93062
-
SSDEEP
393216:wyG5j0NCMfqvXRSYusfo8NcIfsr8QLCJ66:wyG5yCMf5Yun8UrFL666
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45575a23a576575d3682c59b6d351a0e25c4931bcea538467529983108919fcb
Files
-
45575a23a576575d3682c59b6d351a0e25c4931bcea538467529983108919fcb.exe windows:5 windows x86 arch:x86
8f64995054fb0d6c2fb5f8d689ba73f3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SelectClipRgn
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
recvfrom
comdlg32
GetSaveFileNameA
wtsapi32
WTSSendMessageW
Sections
.xilou Size: 528KB - Virtual size: 526KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xilou Size: 236KB - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xilou Size: 72KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xilou Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xilou Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xilou Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xilou Size: 9.9MB - Virtual size: 9.9MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE