Static task
static1
General
-
Target
mimic.exe
-
Size
2.0MB
-
MD5
03cf68c6a32a8f42bcb97eed44e218f8
-
SHA1
ebeb78ee7d68eca6775822288f5730b1bed1d958
-
SHA256
6ba4c3253798909981bbd9e462f0dad2d48db01963701c2b2b2f835254014db2
-
SHA512
aff196f86525d2518586f1a497ed987af8e5f06b3faa6a76120e8fd779776d3cbfdf4199a2c78d101d9f55a715f0b0f9f381fb96649f001a28a2ef561977578f
-
SSDEEP
24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijx:whBPrElwNkto7VINlGFtPtnwjjOa2o
Malware Config
Signatures
Files
-
mimic.exe.exe windows x86
ec5356d8e0f77a28432ffd3fb34115c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatW
lstrcpyW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
SetProcessShutdownParameters
LocalAlloc
GetCurrentThread
LocalFree
GetSystemWindowsDirectoryW
QueryDosDeviceW
FindFirstFileW
SetPriorityClass
FindNextFileW
TerminateProcess
RemoveDirectoryW
FindClose
GetVersionExW
K32GetProcessImageFileNameW
DuplicateHandle
CreateToolhelp32Snapshot
GetExitCodeThread
ProcessIdToSessionId
Process32NextW
K32GetProcessMemoryInfo
Process32FirstW
GetNativeSystemInfo
LoadLibraryW
Module32FirstW
GetWindowsDirectoryW
GetProcAddress
WTSGetActiveConsoleSessionId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
K32GetMappedFileNameW
CreateFileMappingW
GetTickCount
lstrcmpW
IsWow64Process
VirtualQueryEx
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetComputerNameExW
GlobalMemoryStatusEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FormatMessageW
DeleteFiber
ConvertFiberToThread
FreeLibrary
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
CancelIo
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcessId
SetCurrentDirectoryW
Wow64RevertWow64FsRedirection
Sleep
OpenProcess
Wow64DisableWow64FsRedirection
GetCommandLineW
WideCharToMultiByte
GetLocalTime
PostQueuedCompletionStatus
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
MapViewOfFile
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateMutexW
WaitForMultipleObjects
AllocConsole
GetConsoleWindow
ReadFile
SetConsoleCP
GetFileTime
GetDriveTypeW
FindNextVolumeW
GetSystemTime
GetVolumePathNamesForVolumeNameW
CopyFileW
SystemTimeToFileTime
FindVolumeClose
SetVolumeMountPointW
GetDiskFreeSpaceExW
ExitThread
SetFileTime
IsValidLocale
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
ExitProcess
ResumeThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
DeviceIoControl
lstrlenW
FindFirstVolumeW
GetLogicalDrives
GetVolumeInformationW
CreateDirectoryW
lstrcmpiW
MultiByteToWideChar
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
TryEnterCriticalSection
AreFileApisANSI
GetFullPathNameW
GetQueuedCompletionStatus
DeleteTimerQueue
DeleteCriticalSection
FindFirstFileExW
GetCurrentDirectoryW
QueryPerformanceFrequency
GetStringTypeW
CreateTimerQueueTimer
CreateFileW
GetFileSizeEx
GetModuleFileNameW
FlushFileBuffers
MoveFileW
SetFilePointerEx
CloseHandle
DeleteFileW
GetLastError
SetEndOfFile
WriteFile
HeapSize
user32
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wvsprintfW
GetMessageW
UnregisterHotKey
PostMessageW
ShowWindow
PeekMessageW
RegisterHotKey
advapi32
ReportEventW
RevertToSelf
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeNameW
RegCloseKey
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
LookupPrivilegeValueW
QueryServiceStatusEx
DuplicateTokenEx
EnumServicesStatusW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
EqualSid
CreateWellKnownSid
GetUserNameW
LookupAccountSidW
CloseServiceHandle
OpenSCManagerW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
OpenServiceW
SetThreadToken
shell32
CommandLineToArgvW
SHCreateItemFromParsingName
SHEmptyRecycleBinW
ole32
CoSetProxyBlanket
CoTaskMemFree
CoGetObject
CoInitializeEx
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
shlwapi
StrStrIA
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
PathStripPathW
PathFindExtensionW
PathGetArgsW
PathRemoveExtensionW
StrStrW
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
ws2_32
gethostbyname
closesocket
WSAIoctl
bind
recv
send
WSASocketW
WSAStartup
socket
WSAAddressToStringW
WSAGetLastError
setsockopt
htons
WSACleanup
shutdown
inet_ntop
getsockopt
gethostname
WSASetLastError
inet_ntoa
iphlpapi
GetIpNetTable
GetAdaptersInfo
netapi32
NetShareEnum
NetApiBufferFree
mpr
WNetGetConnectionW
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
rstrtmgr
RmGetList
RmShutdown
RmStartSession
RmRegisterResources
RmEndSession
everything32
Everything_GetNumResults
Everything_SetRequestFlags
Everything_Exit
Everything_CleanUp
Everything_GetLastError
Everything_QueryW
Everything_GetResultFullPathNameW
Everything_GetResultSize
Everything_DeleteRunHistory
Everything_SetSort
Everything_IsDBLoaded
Everything_SetSearchW
bcrypt
BCryptGenRandom
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 457KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ