Static task
static1
Behavioral task
behavioral1
Sample
36k字符替换器.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
36k字符替换器.exe
Resource
win10v2004-20230220-en
General
-
Target
36k字符替换器.exe
-
Size
36KB
-
MD5
ee3169936ad93ed403c32d80669bb3ed
-
SHA1
007edc8aa77dc46392dd648d95e40eb142ede420
-
SHA256
5bab624e43e6bab1cd5cf404da54f97d58215e27bf7563fa2b6de29b68e2197e
-
SHA512
679dcc1bded5c8ef57b693d893a68a3d510bb035a54388e2847c544ca1ba1523f7d00e1d8f9672ac9b2f293c80cbc1201cc5c569028836ee83840b1d909c6104
-
SSDEEP
768:I2rZEL6bD7iMYWgrasSjNhFFddZpDK6oh0:IXsD7iMYWg+jNhTZnoq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36k字符替换器.exe
Files
-
36k字符替换器.exe.exe windows x86
9e3d7bdd54b07c7c752be2f81900bb61
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
GetModuleHandleA
lstrcmpA
lstrcpynA
LoadResource
SetEndOfFile
SetFilePointer
CopyFileA
lstrcatA
lstrcpyA
CloseHandle
UnmapViewOfFile
MulDiv
CreateFileMappingA
FreeResource
LockResource
lstrlenA
WaitForSingleObject
SetEvent
FindClose
FindNextFileA
FindFirstFileA
SetThreadPriority
CreateThread
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
GlobalFree
GlobalAlloc
GlobalLock
GetFileSize
CreateFileA
MapViewOfFile
GlobalUnlock
ExitProcess
GetVersion
GetProcAddress
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
HeapReAlloc
HeapFree
RtlUnwind
VirtualFree
WriteFile
HeapDestroy
GetFileType
HeapCreate
SetHandleCount
GetEnvironmentStringsW
GetStdHandle
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStrings
UnhandledExceptionFilter
GetCurrentProcess
GetModuleFileNameA
GetStartupInfoA
GetCommandLineA
VirtualAlloc
GetOEMCP
TerminateProcess
HeapAlloc
GetCPInfo
GetACP
user32
GetDC
ReleaseDC
SetWindowPos
DialogBoxIndirectParamA
GetSystemMetrics
SetWindowTextA
GetParent
GetWindowRect
DefDlgProcA
SendMessageA
RegisterClassA
LoadIconA
LoadCursorA
IsDlgButtonChecked
CheckDlgButton
SetDlgItemInt
EndDialog
SetDlgItemTextA
GetDlgItem
EnableWindow
MessageBoxA
GetDlgItemTextA
gdi32
GetDeviceCaps
GetStockObject
GetObjectA
advapi32
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
shell32
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE