@shutting@0
Static task
static1
Behavioral task
behavioral1
Sample
readme.exe
Resource
win10-20230220-en
General
-
Target
readme.exe
-
Size
348KB
-
MD5
8c6810ccbf8b94ad18edabe648ffd504
-
SHA1
9f3770c114956fb31d04ec3020fe4da03a8ac2d4
-
SHA256
b8f848f137a23fe046b4701a67d07c8e7e1a8fdb066f318424caede7a1e69530
-
SHA512
7bf15296bbdce5aee540b9a6738c65a3f54b773f6aa50b27a98ad8c33544ff60625f650c8bb90fa17a0c60e8b799a88536f5609b41a94784fcb283b810f0b7b9
-
SSDEEP
6144:UMLeUFXXI8t9K/uN6qmhCaHA5DZNyI187cMsU5wgsbZv+:JesY8t9KQ6q9WAZNVOAzzr+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource readme.exe
Files
-
readme.exe.exe windows x86
3e2a18a21617b199cb1442f0d1af4d37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumSystemLocalesA
HeapReAlloc
GetConsoleOutputCP
_lwrite
AddAtomA
GetSystemPowerStatus
PeekConsoleInputA
OpenFileMappingW
GetLargestConsoleWindowSize
GetConsoleAliasesLengthA
UnmapViewOfFile
FlushViewOfFile
GetMailslotInfo
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
CreatePipe
GetNumaAvailableMemoryNode
SetProcessAffinityMask
RtlCaptureStackBackTrace
LoadResource
GlobalAlloc
GetProcAddress
GetNumaProcessorNode
GetModuleHandleW
IsWow64Process
SetEnvironmentVariableW
GetAtomNameW
ScrollConsoleScreenBufferA
SetPriorityClass
FindFirstVolumeMountPointA
CreateMailslotW
WriteConsoleW
ReadFile
GetProcessHeap
SetEndOfFile
RaiseException
RtlUnwind
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
CreateFileA
MultiByteToWideChar
LoadLibraryW
WideCharToMultiByte
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SetFilePointer
CreateFileW
user32
GetCursor
GetCaretBlinkTime
GetCursorInfo
GetCaretPos
msimg32
TransparentBlt
Exports
Exports
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 143KB - Virtual size: 40.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ