Static task
static1
Behavioral task
behavioral1
Sample
p.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
p.exe
Resource
win10v2004-20230220-en
General
-
Target
p.exe
-
Size
114KB
-
MD5
88ef5955f8fa58e141da85580006b284
-
SHA1
44759a6597bad3a287a7b82724a763208c599135
-
SHA256
806761850d19f0cc9f41618e74db471e85c494e952f900f827c1779f2d1c4d31
-
SHA512
6d5e8546618047235c8c050cdaadf25f4bc23c53ad9235aefcaec0f22887f898217a7714cc64c57a53f0d049b0ed4b7697b86c107fdf25585cd6da58846978b1
-
SSDEEP
3072:5ugKcgslk7u5os1d1RQqC62f3ig3XK1EYa:UgLh5oiWs1e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource p.exe
Files
-
p.exe.exe windows x86
2a5bd2c3a68f98ecec1db0a59d6626ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseMutex
Sleep
GetLastError
CloseHandle
CreateThread
InterlockedIncrement
GetTickCount
WaitForSingleObject
RaiseException
CreateMutexA
ReadConsoleW
ReadFile
SetEndOfFile
HeapSize
WriteConsoleW
SetFilePointerEx
CreateFileW
GetProcessHeap
TerminateProcess
InterlockedDecrement
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
HeapReAlloc
FlushFileBuffers
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCurrentProcess
ws2_32
WSACleanup
__WSAFDIsSet
closesocket
gethostbyname
select
WSAStartup
inet_addr
socket
connect
inet_ntoa
htons
ioctlsocket
WSAGetLastError
iphlpapi
IcmpSendEcho
IcmpCreateFile
advapi32
SystemFunction036
Sections
.text Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ