Static task
static1
Behavioral task
behavioral1
Sample
outmain.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
outmain.exe
Resource
win10v2004-20230621-en
General
-
Target
outmain.exe
-
Size
124KB
-
MD5
6039ed3e43262b7dee47c0f3ffb20304
-
SHA1
88414a8fd8c67ef51d783c748aa4fdc3de583614
-
SHA256
53ec4c215a8cccf5125fd7ede88490237002124b95e1ba216a92986a4f04f240
-
SHA512
39c14b46fe70d178e2b3f3dfc4989190a65a3c329f881f7dc44f09cbdd9fb91806a171ea9895f3f6a836c35a4bf721b5e78294829a04b41910c17948c50c1b22
-
SSDEEP
3072:GmevM9UzxMf8i5h9ltdjmos8X2qBJNxqNiyqDX:GDNzOf8iJlvjmDY2cNkif
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource outmain.exe
Files
-
outmain.exe.exe windows x64
98fd2843c944889121758b3801477802
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winhttp
WinHttpConnect
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpen
kernel32
TerminateProcess
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
GetConsoleMode
VirtualAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
Sleep
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcessId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
GetConsoleOutputCP
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
HeapAlloc
HeapFree
LCMapStringW
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ