Static task
static1
Behavioral task
behavioral1
Sample
文书证据.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
文书证据.exe
Resource
win10v2004-20230220-en
General
-
Target
文书证据.exe
-
Size
2.4MB
-
MD5
5c87897bfda33b630277f7bbcadbac0a
-
SHA1
c059fd6eae066e16c0779ba39d122e61ce8129b6
-
SHA256
99247ab7c88789cda5f3d4f37067cff5adabee69e87859bd6023e353d39fb81c
-
SHA512
ad6d77ed73b9a965e80d99105c2d8bf7567979315c11607d41f1a783825a07bbb50b23209fac8304ed0c66cf2c0e3170f69c8ed5d6ee7744819214f9bb60cf98
-
SSDEEP
24576:fuQlSVvDAqpEZYE4arAPoxaH5IjPAgIg8wqJ6/Za3OtJtnZK:GQYOsEZdrAPokZIjQg8T8U3O3tnk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 文书证据.exe
Files
-
文书证据.exe.exe windows x64
89ec9933fef67f89f7c4574b120b3f1a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
CryptGetKeyParam
CryptDecrypt
CryptEncrypt
user32
MessageBoxA
CharNextW
LoadStringW
wsprintfW
MessageBoxW
LoadStringW
GetSystemMetrics
GetCursorPos
CharUpperBuffW
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
GetLogicalProcessorInformation
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
SwitchToThread
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
lstrlenA
lstrlenW
lstrcpyA
lstrcmpiA
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
Sleep
SetFilePointerEx
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
OutputDebugStringW
OpenProcess
LocalFree
IsValidLocale
HeapSize
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetTickCount
GetThreadLocale
GetNativeSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeLibrary
FormatMessageW
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
CreateThread
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep
GetFileSizeEx
QueryFullProcessImageNameW
ole32
CoUninitialize
CoInitialize
msvcrt
_strlwr
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 752KB - Virtual size: 752KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 39KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 512B - Virtual size: 210B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 432B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 109B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.pdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ