Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
335KB
-
MD5
a14d01d96ea78f39f7e118582dad3cb9
-
SHA1
8cf40dc12117e56aea899ddf2c381443d6537d21
-
SHA256
6c6345c6f0a5beadc4616170c87ec8a577de185d53345581e1b00e72af24c13e
-
SHA512
8982d19b443fc48aaa84ef5c8a0661a2e757b9ee072d2dc4619746885b94135c59da6f52e656f5e09411386ba3b1b67e24f62b8d3493b18ed6b7ae6838cd2984
-
SSDEEP
6144:xFH8RIT6Fam4StJ3rXDW49wY7SkzU0iaODgKYleQ4HzP:xWdtXDzCwGMAP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows x64
77e359c59376704055cd15c273e85720
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegFlushKey
kernel32
EnterCriticalSection
DeleteCriticalSection
GetCommandLineW
lstrlenA
FreeLibrary
WaitForSingleObject
SetEvent
RegisterApplicationRestart
LoadLibraryW
Sleep
CreateEventW
WaitForMultipleObjects
HeapSetInformation
GetCurrentThreadId
CloseHandle
GetVersionExW
GetProcAddress
GetSystemInfo
GetFullPathNameW
WideCharToMultiByte
ReadFile
GetProcessHeap
SetEndOfFile
GetCurrentDirectoryW
VirtualQuery
SetThreadStackGuarantee
VirtualAlloc
VirtualProtect
FlushFileBuffers
SetStdHandle
CreateFileW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
MultiByteToWideChar
LCMapStringW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
HeapSize
GetOEMCP
GetACP
GetCPInfo
OutputDebugStringA
RtlCaptureContext
RtlVirtualUnwind
lstrlenW
GetModuleFileNameW
GetFileAttributesW
LeaveCriticalSection
GetSystemDirectoryW
InitializeCriticalSection
WriteConsoleW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
FlsAlloc
GetCommandLineA
GetStartupInfoW
GetLastError
HeapFree
HeapReAlloc
ExitThread
FlsSetValue
FlsGetValue
CreateThread
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
EncodePointer
DecodePointer
FlsFree
SetLastError
user32
UpdateWindow
SetWindowTextW
DispatchMessageW
EnableWindow
DestroyWindow
SetTimer
GetWindowRect
PostQuitMessage
PostMessageW
KillTimer
MsgWaitForMultipleObjects
GetKeyState
SetForegroundWindow
GetFocus
DialogBoxParamW
CallNextHookEx
IsWindowEnabled
GetWindowLongPtrW
GetClientRect
SetFocus
TranslateMessage
IsDialogMessageW
LoadIconW
GetWindowLongW
PeekMessageW
GetDlgItem
EndDialog
GetDesktopWindow
SetWindowPos
LoadStringW
CheckDlgButton
ShowWindow
CreateDialogParamW
SetWindowsHookExW
AdjustWindowRectEx
UnhookWindowsHookEx
MessageBoxW
SendMessageW
comdlg32
GetSaveFileNameW
shell32
ShellExecuteW
ole32
CoUninitialize
CoInitialize
CoInitializeSecurity
CoCreateInstance
Sections
.text Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ