Static task
static1
Behavioral task
behavioral1
Sample
findstr.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
findstr.exe
Resource
win10v2004-20230221-en
General
-
Target
findstr.exe
-
Size
61KB
-
MD5
18f02c555fbc9885df9db77754d6bb9b
-
SHA1
c568d518052c4ba25f462b70d96a663f24a2c9da
-
SHA256
28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37
-
SHA512
6ed4aaf1d260a96ed9d52f81fc53cb0f974a11d852e1c5b7de5c14483b088d47fb715f1ed7af101fcbe6e9c820d423b0c87e2610a307a7d7a85d6b11bde233f6
-
SSDEEP
768:6LXj35lo94eRLJwFA9gjgH+hFF0jo7A7uRA6:6Lz04e1mj7hfKosCRA6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource findstr.exe
Files
-
findstr.exe.exe windows x86
a79c35de7194e499344a5a045217c1af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
FindNextFileA
FindFirstFileA
ReadFile
WriteFile
LeaveCriticalSection
SetConsoleTextAttribute
GetStdHandle
EnterCriticalSection
SetFileApisToOEM
IsDBCSLeadByte
GetLastError
FormatMessageA
CreateFileA
GetFileAttributesA
ExitProcess
SetConsoleCtrlHandler
InitializeCriticalSection
UnmapViewOfFile
CloseHandle
MapViewOfFile
CreateFileMappingA
GetFileSize
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrlenA
GetConsoleOutputCP
GetConsoleScreenBufferInfo
SetThreadPreferredUILanguages
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter
msvcrt
strcpy_s
strcat_s
_splitpath_s
malloc
fprintf
isalnum
isspace
isprint
_iob
_ultoa
strchr
fclose
fgets
fopen
_itoa
_isatty
tolower
isxdigit
_stricmp
_setmode
_fileno
strncpy_s
_wsetlocale
clock
memset
__getmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
swprintf_s
isalpha
_strupr
_strnicoll
_strncoll
memmove
memcpy
exit
free
strcspn
strcoll
isupper
_strlwr
islower
sprintf_s
user32
CharToOemA
ntdll
RtlUnicodeToOemN
DbgPrint
RtlMultiByteToUnicodeN
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ