Static task
static1
Behavioral task
behavioral1
Sample
金属系品种对接.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
金属系品种对接.exe
Resource
win10v2004-20230621-en
General
-
Target
金属系品种对接.com
-
Size
5.1MB
-
MD5
b30a3ff5157e6a1c94dba0d80c411de5
-
SHA1
fac65038ad8af7e3c21e6111edebc9c62f038669
-
SHA256
7485f8f2393809636352a18eb29822522ba44871eb44c7384395e7db689041a6
-
SHA512
20819dc20aaa7af2db896f810629812fc33426821e3a2663b6be83a483bb12050c0849a4dd33a1240b4ca29481bf44be99bac9713eb29566fc40b331e8ae7b56
-
SSDEEP
49152:STyzrkQPMPyTikrI97fQodDLGBgQMKnm+Iw5YoIHPKCuEx711Atan595iM:njPMPyOkE97fQodvGyzt+Iw5Wi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 金属系品种对接.com
Files
-
金属系品种对接.com.exe windows x86
414dd7492c0be530e074e8cedbe540d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetEnvironmentVariableA
FindFirstFileA
GetProcAddress
VirtualAlloc
CopyFileA
FindClose
LoadLibraryA
Process32Next
GlobalMemoryStatusEx
GetModuleFileNameA
FindNextFileA
CreateToolhelp32Snapshot
CloseHandle
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
GetConsoleWindow
lstrcpynA
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetTickCount
GetModuleHandleA
FreeConsole
AllocConsole
SetConsoleCtrlHandler
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
LockResource
GlobalAlloc
GlobalReAlloc
GlobalFree
ReadFile
CreateDirectoryW
GetLastError
EncodePointer
DecodePointer
GetFileAttributesExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
HeapAlloc
GetDriveTypeW
GetFullPathNameA
GetSystemTimeAsFileTime
GetModuleHandleExW
AreFileApisANSI
GetCommandLineA
RaiseException
Process32First
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
HeapSize
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
CreateFileW
GetProcessHeap
GetCurrentDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
GetFileType
InitOnceExecuteOnce
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetConsoleCP
SetFilePointerEx
HeapReAlloc
OutputDebugStringW
LoadLibraryW
CompareStringEx
LCMapStringEx
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
ReadConsoleW
SetEnvironmentVariableA
lstrlenA
LocalFree
InterlockedDecrement
ExitProcess
GetLocalTime
RtlUnwind
Sleep
user32
ValidateRect
GetWindowRect
AdjustWindowRectEx
ScreenToClient
LoadCursorA
DestroyIcon
IsWindowVisible
ReleaseDC
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
GetForegroundWindow
SetWindowPos
DestroyWindow
CreateWindowExA
GetAsyncKeyState
GetDC
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcA
DrawTextA
ShowWindow
PostMessageA
advapi32
OpenProcessToken
GetLengthSid
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
shell32
ExtractIconA
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
ws2_32
socket
recv
WSACleanup
htons
inet_addr
WSAStartup
connect
send
closesocket
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ