Static task
static1
General
-
Target
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.zip
-
Size
115KB
-
MD5
017f6391bea94dbee3c4460fb0a85428
-
SHA1
cf070039c409c16c431ff24085f8181312e203f6
-
SHA256
befa4291422e6bc785936ba7aaab01e0f90e459c5cbf6002def77a7d0eaae7be
-
SHA512
3c4920683f0521ac78468e625ac482aea2ee6acfe8a2189a0830f28a83bf94337f8e14dea35afefc5c69bcd18a5b161836ff6a6cdfa635164f43c546d6d7edcd
-
SSDEEP
3072:U98utLotUul/9NUeyLgtLdu6tVSr2rpY3y1EV:U1LotUuNxhI2y4EV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Files
-
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.zip.zip
Password: infected
-
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe.exe windows x86
df8a796efae3afbd108a0518d0602ca7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptDecodeObjectEx
CryptBinaryToStringA
CryptStringToBinaryA
CertGetNameStringW
wininet
InternetCrackUrlA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetConnectA
shlwapi
StrSpnA
StrPBrkA
PathCombineW
PathSkipRootW
PathRemoveExtensionW
StrCmpIW
StrStrIW
StrToIntA
StrCmpNW
PathMatchSpecW
StrChrW
StrToInt64ExA
PathUnquoteSpacesW
StrCmpNIA
PathFindFileNameW
StrStrIA
StrChrA
StrChrIA
StrCpyNW
StrCmpNIW
StrChrIW
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoSizeW
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
imagehlp
CheckSumMappedFile
ws2_32
sendto
inet_ntoa
inet_addr
htonl
shutdown
closesocket
gethostbyname
WSAStartup
socket
htons
kernel32
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
SetConsoleTitleW
MultiByteToWideChar
CreateThread
WideCharToMultiByte
MoveFileW
IsBadWritePtr
LocalFree
TlsAlloc
CreateDirectoryW
SetErrorMode
GetSystemWindowsDirectoryW
GetModuleHandleW
OpenMutexW
GetVolumeInformationW
lstrcatW
GetProcAddress
GetDateFormatW
SetFilePointerEx
WaitForSingleObject
SetEvent
OutputDebugStringW
SetFileTime
InitializeCriticalSection
LeaveCriticalSection
GetTimeFormatW
GetFileAttributesW
FileTimeToSystemTime
GetFileSizeEx
EnterCriticalSection
CreateEventW
GetFileTime
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
lstrcpyW
GetStdHandle
ExitProcess
GetCurrentThreadId
GetTempFileNameW
MapViewOfFile
WriteConsoleW
FindResourceW
FreeLibrary
LoadResource
CreateProcessW
LoadLibraryExW
LoadLibraryW
CopyFileW
SizeofResource
ReadProcessMemory
lstrcpynW
CreateProcessA
TerminateProcess
FlushInstructionCache
GetTempPathW
VirtualAllocEx
CreateFileMappingW
FormatMessageW
OpenEventW
DeleteFileW
WriteProcessMemory
ResumeThread
FindFirstFileW
GetModuleFileNameW
FindClose
SetFileAttributesW
GetCommandLineW
GetFileAttributesA
CreateMutexW
SearchPathW
GetCurrentProcess
IsBadStringPtrW
GetCurrentThread
CreateToolhelp32Snapshot
SetThreadPriority
VirtualProtect
IsBadReadPtr
OutputDebugStringA
SetProcessShutdownParameters
GetModuleHandleA
Process32NextW
GetSystemInfo
lstrlenA
lstrcpyA
GetEnvironmentVariableW
IsBadCodePtr
IsBadStringPtrA
GetVersionExW
GetTickCount
WaitForMultipleObjects
SetConsoleCursorPosition
AllocConsole
ExpandEnvironmentStringsW
GetWindowsDirectoryW
MulDiv
lstrcmpiW
SetCurrentDirectoryW
lstrcmpiA
GetLastError
FlushFileBuffers
lstrlenW
CreateFileW
UnmapViewOfFile
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
QueryDosDeviceW
FindNextFileW
GetCurrentProcessId
HeapReAlloc
HeapAlloc
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
ReadFile
GetSystemWow64DirectoryW
Sleep
lstrcpynA
GetComputerNameA
Process32FirstW
GetSystemDirectoryW
WriteFile
RtlUnwind
GetProcessHeap
GetFileSize
HeapFree
GetHandleInformation
MoveFileExW
SetFilePointer
LockResource
OpenProcess
SetEndOfFile
advapi32
LookupPrivilegeValueW
SetKernelObjectSecurity
CreateWellKnownSid
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
DuplicateToken
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegFlushKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegOpenKeyW
RegCreateKeyExW
AdjustTokenPrivileges
CryptGetKeyParam
CryptAcquireContextW
CryptDestroyKey
GetLengthSid
RegEnumKeyW
ConvertSidToStringSidW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegQueryValueExW
SetEntriesInAclW
SetNamedSecurityInfoW
InitiateSystemShutdownExW
CryptGenRandom
CryptReleaseContext
GetUserNameW
netapi32
NetUserEnum
NetUserSetInfo
NetUserGetInfo
NetApiBufferFree
user32
DefWindowProcW
GetSystemMetrics
DispatchMessageW
GetForegroundWindow
RegisterClassW
CreateWindowExW
PeekMessageW
TranslateMessage
wsprintfW
wsprintfA
CharLowerBuffA
ExitWindowsEx
GetSystemMenu
DeleteMenu
FindWindowW
GetKeyboardLayoutList
EnableMenuItem
ReleaseDC
SystemParametersInfoW
GetDC
DrawTextA
FillRect
GetLastInputInfo
UnregisterClassW
RegisterClassExW
shell32
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
SHChangeNotify
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoInitialize
ntdll
memmove
ZwOpenProcess
isspace
ZwClose
ZwQuerySystemInformation
_chkstk
ZwOpenDirectoryObject
_allmul
_aullshr
_alldiv
ZwQueryInformationProcess
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
ZwOpenSection
memset
_aulldvrm
memcpy
NtQueryVirtualMemory
oleaut32
SysFreeString
SysAllocString
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject
Sections
.text Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ