Static task
static1
Behavioral task
behavioral1
Sample
Kang Min-chol Edits 2.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Kang Min-chol Edits 2.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Kang Min-chol Edits 2.lnk
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Kang Min-chol Edits 2.lnk
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
backdoor.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
backdoor.exe
Resource
win10v2004-20230220-en
General
-
Target
Archive.zip
-
Size
1.8MB
-
MD5
13aaa52cab1cfaf44812756de9e7f89b
-
SHA1
7f2387c6a4009c7cd179459347f9bd2cda1a22ed
-
SHA256
539ef744066a46293e1ffa3ecc5015be6c2c7d622d176b18916f06b365597e46
-
SHA512
b5a0700026980dbe7bfbcc809af79ff57339e89605cb7cb9884466ec83c5e74ca42637b0a516c902cb93c2b3fff02d60c8f3db3d34eccfed78d51e18c0248451
-
SSDEEP
49152:O1yZbBwzUd/umVK4xhHnyTAnzNyTX4WxHf2ILG:OlUdxVK47nyIzNs4ks
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/backdoor.exe
Files
-
Archive.zip.zip
-
Kang Min-chol Edits 2.doc.doc windows office2003
-
Kang Min-chol Edits 2.lnk.lnk
-
Kang Min-chol Edits 2.zip.zip
-
__MACOSX/._Kang Min-chol Edits 2.doc
-
__MACOSX/._Kang Min-chol Edits 2.lnk
-
__MACOSX/._Kang Min-chol Edits 2.zip
-
__MACOSX/._backdoor.exe
-
__MACOSX/._fantasy
-
backdoor.exe.exe windows x86
1359bc5e32064d6cd85d5d1dabfed078
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
CreateMutexA
WaitForSingleObject
ReleaseMutex
TerminateThread
CreateThread
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
lstrcpyW
lstrlenW
WriteFile
ExpandEnvironmentStringsA
DeleteFileW
CreateFileW
GetDriveTypeW
CreateMutexW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetLogicalDrives
GetTempPathW
GetVolumeNameForVolumeMountPointW
LoadLibraryA
GetProcAddress
DeviceIoControl
FindFirstFileA
GetCurrentProcess
GetSystemTimes
FindNextFileA
CreateToolhelp32Snapshot
K32GetProcessMemoryInfo
Process32FirstW
GetComputerNameW
GlobalMemoryStatusEx
IsWow64Process
CloseHandle
CheckRemoteDebuggerPresent
DeleteFileA
SetFileAttributesA
FileTimeToSystemTime
GetFullPathNameW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetConsoleMode
ReadConsoleInputA
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
Sleep
SetFileAttributesW
HeapSize
FindClose
InitializeCriticalSectionEx
FindNextFileW
HeapFree
OpenProcess
TerminateProcess
VirtualAlloc
ExpandEnvironmentStringsW
VirtualFree
GetProcessHeap
SystemTimeToFileTime
SetFilePointer
FlushConsoleInputBuffer
GlobalMemoryStatus
GetModuleHandleA
SetEndOfFile
WriteConsoleW
SetStdHandle
FindFirstFileExA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
IsDebuggerPresent
DeleteCriticalSection
Process32NextW
FindFirstFileW
WideCharToMultiByte
EncodePointer
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
LocalFree
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
DuplicateHandle
CreateProcessA
CreateProcessW
ExitProcess
GetModuleHandleExW
ReadFile
MoveFileExW
GetStdHandle
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
GetCurrentDirectoryW
user32
GetWindowTextW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
wsprintfW
GetForegroundWindow
GetWindowTextA
GetKeyState
IsWindowVisible
EnumWindows
advapi32
RegOpenKeyExW
SystemFunction036
RegSetKeyValueW
RegCloseKey
RegDeleteKeyValueW
ReportEventA
RegQueryValueExW
RegGetValueA
GetUserNameW
DeregisterEventSource
RegisterEventSourceA
ole32
CoTaskMemAlloc
PropVariantClear
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
oleaut32
VariantInit
VariantClear
shlwapi
SHStrDupW
ord219
ord12
iphlpapi
GetIpAddrTable
wininet
InternetOpenUrlA
InternetConnectW
InternetCloseHandle
HttpSendRequestW
InternetCrackUrlW
InternetOpenW
HttpQueryInfoA
InternetQueryOptionW
HttpOpenRequestW
InternetCheckConnectionW
InternetSetOptionW
InternetOpenA
InternetReadFile
Sections
.text Size: 805KB - Virtual size: 804KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 292KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
fantasy