Static task
static1
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20230220-en
General
-
Target
test.exe
-
Size
778KB
-
MD5
0ab1951982b3112db58c0ad4db674a3f
-
SHA1
e2c768e7f6fa5029efe5a186f912013e5d76007a
-
SHA256
b7e6c669e598f5fe106cebe80b12cd042f08a51431dd8ffc1f19542b8d7fcfea
-
SHA512
013a58243e3212800f0d7421d6d41f5daee6dbecceb5f3595db16793e60043e94ea5e1c519c28bc0372b7a42542b2c81b8d42773e1b0e5c708950a1e6fee51ec
-
SSDEEP
6144:TFsTvbjKJI3nv0n0eEMnVmvnyh++ilUJYUICgILZrRSiScezGs8v:T6bCenv+EMnwvyh+lUJYUIohezG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource test.exe
Files
-
test.exe.exe windows x64
2b696dd8f4093e234fe0628b2956902b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
ClearEventLogA
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
ReadEventLogA
RegNotifyChangeKeyValue
RegisterEventSourceA
kernel32
CloseHandle
CreateFileA
CreatePipe
CreateProcessA
DeleteCriticalSection
DeleteFileA
DisconnectNamedPipe
EnterCriticalSection
EscapeCommFunction
FindClose
FlushFileBuffers
GetBinaryTypeA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetFileType
GetLargestConsoleWindowSize
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OpenEventA
PurgeComm
QueryPerformanceCounter
ReadConsoleW
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCommBreak
SetCommMask
SetConsoleMode
SetCurrentDirectoryA
SetEvent
SetNamedPipeHandleState
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
lstrlenA
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_snprintf
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 628KB - Virtual size: 627KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE