Static task
static1
Behavioral task
behavioral1
Sample
Windows XP Professional SP3 Black Edition March 2019.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Windows XP Professional SP3 Black Edition March 2019.exe
Resource
win10v2004-20220812-en
General
-
Target
Windows XP Professional SP3 Black Edition March 2019.exe
-
Size
266KB
-
MD5
c67140ec03f37049bb32f2c6a5cffd77
-
SHA1
fb08c1d842895c47038e26fabc2ffe27a732ef0f
-
SHA256
eb8a541e6d870636fc0c641a49efd195e0319e5aa7deca75cf337c22c7c023f7
-
SHA512
ecfb13be655a6ecfd4f39c2b224c622a07a2a611b67941c781a776fd4074ed125b3ba74777736e751641b337fe7dea2809a021bd930dfade6eb559cfb0e950e6
-
SSDEEP
6144:dm+l20Z7hej4UU5Se+qrmT2ZPiky+awTKlYJ+f:I42CejbU53+GZPi6hY5
Malware Config
Signatures
Files
-
Windows XP Professional SP3 Black Edition March 2019.exe.exe windows x64
5e7d256bbd8a6a346093868e44730b11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
CreateFileA
CloseHandle
GetFileSize
UpdateResourceA
EndUpdateResourceA
SizeofResource
WriteFile
FindResourceA
CopyFileA
LoadResource
CreateProcessA
GetConsoleScreenBufferInfo
HeapFree
SetConsoleTextAttribute
GetStdHandle
HeapAlloc
GetProcessHeap
WriteConsoleW
BeginUpdateResourceA
GetModuleFileNameA
LockResource
ReadFile
CreateFileW
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileType
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadConsoleW
HeapSize
RtlUnwind
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
shlwapi
PathStripPathA
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ