Static task
static1
Behavioral task
behavioral1
Sample
ByteCodeGenerator.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ByteCodeGenerator.exe
Resource
win10v2004-20230220-en
General
-
Target
ByteCodeGenerator.exe
-
Size
26KB
-
MD5
2fe1aeae85c28eeb791d09fb2befeec9
-
SHA1
cce4cc072285938b1547ca4bb7d45b86a987411c
-
SHA256
7e305c28c8562d9c13f61638139592d2e5a777b241c2e7aa4d7c63ed385f565b
-
SHA512
7349dcb7a9b72ecd7533b9edb7314c5d82bffb893a5cb0451c65d0e789bac2b1835a43a4e4509dff1f0118a28244b793da125b361f0331f20de1522502c97129
-
SSDEEP
384:+butdff+I5OovzMR3fccL7w/W42/7BBdGc9IJWXuuO1um6tSRBRWZbhW0hk:+butdf2RovzcDLcO7vCBsSRBQ6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ByteCodeGenerator.exe
Files
-
ByteCodeGenerator.exe.exe windows x86
4e3a6679d259bfe5c4d9e3e15535e744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
OpenProcessToken
TraceMessage
GetTokenInformation
EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
RegGetValueW
UnregisterTraceGuids
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW
kernel32
CloseHandle
LocalFree
SetThreadPriority
GetCurrentThread
GetCurrentProcess
ExitProcess
GetLastError
GetThreadPriority
UnmapViewOfFile
CompareStringEx
SetEndOfFile
SetFilePointer
WriteFile
CompareStringOrdinal
GetFileSizeEx
MapViewOfFile
CreateFileMappingW
CreateFileW
msvcrt
memcmp
memcpy
_purecall
_vsnwprintf_s
exit
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
memcpy_s
memset
_XcptFilter
__p__commode
ntdll
RtlInsertElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
NtQueryInformationThread
NtSetInformationThread
RtlNtStatusToDosError
RtlNumberGenericTableElementsAvl
RtlInitializeGenericTableAvl
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlEnumerateGenericTableAvl
api-ms-win-core-com-l1-1-1
CoUninitialize
CoTaskMemAlloc
CoInitializeEx
CoCreateInstance
CoTaskMemFree
rpcrt4
RpcServerUseProtseqEpW
NdrServerCall2
RpcServerUnregisterIf
RpcServerInqBindings
RpcObjectSetType
RpcServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingVectorFree
RpcServerRegisterIf3
UuidFromStringW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-1
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleA
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-2
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
urlmon
CreateUri
CoInternetParseIUri
oleaut32
SysFreeString
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ