Static task
static1
Behavioral task
behavioral1
Sample
WinMain.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
WinMain.exe
Resource
win10v2004-20230621-en
General
-
Target
WinMain.exe
-
Size
123KB
-
MD5
01f5ec34c929e731c48d029e463f0169
-
SHA1
4a8e714929f8669a32970738192dfb1a911ceb94
-
SHA256
f4036d6ef4c8edd8761781f9e33143b4cd448cf4f94e27d74cd6f6e2b0002269
-
SHA512
e59ab58cec4e4f0e4953834334ffc57760ca17b673e1fd3d4fb1f90166ebfbc0fe5a720a837d793ecbbbadd8bcffeb4c2ba3c21b89dfc9a14500a6994a8ee4fa
-
SSDEEP
3072:6DMqx8Fxiked5VJIgrqoVpcCd+sqTVyEV06:6D/UQked9ZrqqqaiTV1V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WinMain.exe
Files
-
WinMain.exe.exe windows x64
98fd2843c944889121758b3801477802
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winhttp
WinHttpConnect
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpen
kernel32
TerminateProcess
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
GetConsoleMode
VirtualAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
Sleep
GetCurrentThreadId
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcessId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
GetConsoleOutputCP
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
HeapAlloc
HeapFree
LCMapStringW
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ