_gekkko@8
Static task
static1
Behavioral task
behavioral1
Sample
f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe
Resource
win10v2004-20220414-en
General
-
Target
f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab
-
Size
3.5MB
-
MD5
430153f225c19501842717a80283c9ed
-
SHA1
b53056dd325af27d8c295731dbbe102ace42def6
-
SHA256
f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab
-
SHA512
a9051ad3af63a3bed0c63ab7e6ea26a8b4fc944bbf4eca394f1ea07f645c0fd94551fe2b33d86ca62fc86f6ee2ee515ad95b51473511466a679858468cdba8d2
-
SSDEEP
98304:YvVkC9FlEliPSwOYGcN3YC4YIEEPRqABmxzl:Srdy8S4G2zIEGRqA0xz
Malware Config
Signatures
Files
-
f113556c666089edb042e0fe628d12c5e705443ee004d7633f6d1ac8f129e9ab.exe windows x86
e2dc96984164f385628a6a502bf3cc0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetComputerNameA
GetThreadContext
GlobalMemoryStatus
SetFilePointer
WritePrivateProfileStructA
TlsGetValue
SetLocalTime
FindResourceExW
LoadResource
GetNamedPipeHandleStateA
GetProfileSectionA
CancelWaitableTimer
SetComputerNameW
FreeEnvironmentStringsA
_lclose
SetTapeParameters
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
SetProcessPriorityBoost
GlobalAlloc
GetPrivateProfileIntA
LocalShrink
CopyFileW
SetConsoleMode
VerifyVersionInfoA
lstrcatA
GetBinaryTypeW
GetACP
ExitThread
lstrlenW
VirtualUnlock
RaiseException
DeactivateActCtx
GetLastError
IsDBCSLeadByteEx
GetProcAddress
IsValidCodePage
LoadLibraryA
CreateSemaphoreW
UnhandledExceptionFilter
BuildCommDCBAndTimeoutsW
GetProfileStringA
SetFileApisToANSI
AddAtomA
GetPrivateProfileStructA
GetSystemInfo
SetEnvironmentVariableA
WaitCommEvent
GetCurrentDirectoryA
CompareStringA
GetConsoleCursorInfo
CloseHandle
DebugBreak
FindActCtxSectionStringW
GetSystemTime
lstrcpyA
WriteConsoleW
FlushFileBuffers
InterlockedIncrement
InterlockedDecrement
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
HeapFree
RtlUnwind
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
FatalAppExitA
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
GetFileAttributesA
CreateFileA
IsProcessorFeaturePresent
WriteFile
GetModuleFileNameW
HeapCreate
HeapDestroy
MultiByteToWideChar
ReadFile
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
HeapSize
GetCPInfo
GetOEMCP
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
SetConsoleCtrlHandler
HeapReAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
SetEndOfFile
FreeLibrary
LoadLibraryW
LCMapStringW
CreateFileW
user32
GetCursorPos
Exports
Exports
Sections
.text Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.2MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 561KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ