Static task
static1
General
-
Target
SECOH-QAD.exe
-
Size
4KB
-
MD5
38de5b216c33833af710e88f7f64fc98
-
SHA1
66c72019eafa41bbf3e708cc3824c7c4447bdab6
-
SHA256
9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
-
SHA512
99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
-
SSDEEP
48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SECOH-QAD.exe
Files
-
SECOH-QAD.exe.exe windows x64
80d4996be4f3279aee256ea8a8635393
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
wcsstr
wcslen
_wcsicmp
wcschr
kernel32
Thread32Next
ResumeThread
SuspendThread
WriteProcessMemory
CloseHandle
ExitProcess
GetCommandLineW
DebugActiveProcessStop
CreateProcessW
WaitForSingleObject
CreateRemoteThread
OpenProcess
Thread32First
VirtualFreeEx
Sleep
GetExitCodeProcess
GetStartupInfoW
GetLastError
GetProcAddress
VirtualAllocEx
Process32FirstW
OpenThread
GetExitCodeThread
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
Sections
.text Size: 1024B - Virtual size: 1023B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ