Static task
static1
General
-
Target
powershell.exe
-
Size
443KB
-
MD5
b94110f627d2ba6c57eb84a0f9575b27
-
SHA1
8d9fbb33a3894eb41dd2e976844c2a23abd8cd50
-
SHA256
b7327b511cbadc9c471f5aa7438e47ffec3430145c8d23e0e3256183295ca974
-
SHA512
ec5478f311fc610b3a36569474eb4ec319d78826697ebc682592975bc338470eae1237b5307cde83569f950a958bb41eabf7a770c01c137331468e29f93b167e
-
SSDEEP
12288:UZ+mnIeKeW2KXzJ4pdd3klnnWosPhnzq:GIoW2KjJ4Td3kJnbsPhnzq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource powershell.exe
Files
-
powershell.exe.exe windows x86
c5e22ae5b5f7f22df3a5c34e34002f28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_controlfp
memmove
memcpy
_except_handler4_common
_wcsicmp
memcmp
fclose
_wfopen
_itow_s
wcstoul
wcschr
__uncaught_exception
_CxxThrowException
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_callnewh
malloc
wcsncmp
memmove_s
wcsrchr
free
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_purecall
??3@YAXPAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPAX@Z
__CxxFrameHandler3
_wcsnicmp
memset
atl
ord30
kernel32
LCIDToLocaleName
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
SearchPathW
GetModuleHandleW
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
FindResourceExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
GetProcessHeap
GetCurrentProcessId
VerSetConditionMask
DeleteCriticalSection
AcquireSRWLockShared
IsDebuggerPresent
IsWow64Process
SetConsoleTitleW
GetFileType
TerminateProcess
LoadResource
GetStartupInfoW
GetModuleFileNameA
LocalFree
FindFirstFileW
CreateFileMappingW
CreateMutexExW
CompareStringW
GetProcAddress
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
GetLastError
GetCurrentProcess
GetStdHandle
ReleaseSemaphore
WriteFile
WriteConsoleW
GetModuleHandleExW
ExpandEnvironmentStringsW
MapViewOfFile
VerifyVersionInfoW
HeapAlloc
LoadLibraryExW
SetThreadUILanguage
GetModuleFileNameW
SetErrorMode
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
ReleaseMutex
DebugBreak
FormatMessageW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
oleaut32
SysStringLen
SafeArrayPutElement
VariantClear
SafeArrayCreate
SysAllocString
SysFreeString
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
EventUnregister
EventRegister
RegQueryValueExW
EventSetInformation
EventWriteTransfer
ole32
CoTaskMemAlloc
CoInitialize
PropVariantClear
CoUninitialize
CoCreateInstance
CoInitializeEx
user32
LoadStringW
mscoree
CorBindToRuntimeEx
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 351KB - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ