Static task
static1
Behavioral task
behavioral1
Sample
autochk.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
autochk.exe
Resource
win10v2004-20220812-en
General
-
Target
autochk.exe
-
Size
870KB
-
MD5
387a1e98be548e4f199343cba01e9d6d
-
SHA1
b80defce4d019832bf018e41d6c43bdc679ca9e5
-
SHA256
4a2b66e5587be0bdec99c1ec758db67f35d1988b1fcd916355d6473e3bcdd13e
-
SHA512
76e14ad9249f39fc63bda3fe4667c1077854ba7806bc04537c7ea5a1b1751ca151598d7015aa4165f847bad7a4348171255bb3a14519f7d9cd02c0b66030e7b8
-
SSDEEP
12288:VFB9rDh9sZjcNR/rd3WTW9r6anRzKOl5T+AZOtJ1a6Q:H3rDzIcNR/r8ErtR2UT+5JcD
Malware Config
Signatures
Files
-
autochk.exe.exe windows x64
4797ba4e8be7f7f6b4b74c079124a2f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
_wcsicmp
NtQuerySystemTime
NtOpenKey
NtWriteFile
RtlInitUnicodeString
NtSerializeBoot
NtFsControlFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlEqualUnicodeString
wcsstr
NtQueryDirectoryObject
NtCreateFile
RtlPrefixUnicodeString
NtClose
NtOpenDirectoryObject
LdrSetMUICacheType
NtQueryValueKey
NtOpenFile
NtTerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnhandledExceptionFilter
isspace
RtlUnicodeStringToAnsiString
RtlAllocateHeap
RtlFreeAnsiString
RtlNormalizeProcessParams
NtQueryInformationFile
NtDeviceIoControlFile
NtQueryVolumeInformationFile
wcstoul
_wcstoui64
NtReadFile
RtlRaiseStatus
memmove
RtlQueryRegistryValuesEx
NtSetThreadExecutionState
RtlRandomEx
NtQueryPerformanceCounter
_vsnprintf
_vsnwprintf
RtlMultiByteToUnicodeN
RtlOemToUnicodeN
RtlUnicodeToMultiByteN
RtlUnicodeToOemN
wcsspn
_wtol
_wtoi64
_wcsupr
_wcslwr
wcschr
NtDelayExecution
NtQuerySystemInformation
RtlSizeHeap
RtlFreeHeap
NtDisplayString
swprintf_s
NtCreateEvent
NtWaitForMultipleObjects
NtCancelIoFile
qsort
isprint
NtDrawText
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
NtOpenProcessToken
NtAdjustPrivilegesToken
NtShutdownSystem
RtlExpandEnvironmentStrings_U
NtSetInformationFile
RtlValidRelativeSecurityDescriptor
RtlGetVersion
RtlTimeToTimeFields
VerSetConditionMask
RtlVerifyVersionInfo
wcsncmp
RtlFindMessage
RtlInitAnsiStringEx
RtlAnsiStringToUnicodeString
RtlFormatMessage
RtlWriteRegistryValue
RtlComputeCrc32
DbgPrint
RtlCrc64
RtlUpcaseUnicodeString
RtlSystemTimeToLocalTime
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlLengthSid
RtlCopySid
RtlAddAce
RtlCreateAcl
RtlQueryInformationAcl
RtlCreateSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlNewSecurityObject
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlAddAccessAllowedAce
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlInitializeBitMap
RtlSetBits
RtlLookupElementGenericTable
RtlClearBits
RtlFindSetBits
RtlDeleteElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlNumberOfSetBits
DbgPrintEx
NtFlushBuffersFile
__C_specific_handler
__chkstk
memcmp
memcpy
memset
wcscmp
Sections
.text Size: 573KB - Virtual size: 572KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ