Static task
static1
Behavioral task
behavioral1
Sample
112.exe
Resource
win10-20230703-en
General
-
Target
112.exe
-
Size
2.5MB
-
MD5
3ea23755fdb530f1d4733e1c329b6262
-
SHA1
94178e8c1c34374a17a6d7313ae84c30a21e42b6
-
SHA256
34c1447f2bc18265a71260fd20c773301aab0ff700518ab2da8fe0ce9e55a2eb
-
SHA512
536697a9ec68c523b4628b6116fe60f15d05fa92c5fcdab3391256c349764d6d1bf0783cc11839c204ceba8b1ff3d760e1ee30fa448bc02823293056adf6e7a7
-
SSDEEP
24576:ENOhnEd8X+bXTTH4xMBl0R/qK2RLWngE0pHa6ozFnNyr9UEK2Hyn0hy:yS+bjUxMyqK+LWngB7GFM/K2H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 112.exe
Files
-
112.exe.exe windows x64
baaa8b67368fb794e5dfd540198f639b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetModuleFileNameA
SizeofResource
GetCurrentProcess
DeviceIoControl
GetModuleFileNameW
CreateMutexA
WaitForSingleObject
CreateFileW
GetFileAttributesW
CreateToolhelp32Snapshot
GetLastError
GetFileAttributesA
Process32NextW
SetFileInformationByHandle
QueryFullProcessImageNameA
CreateFileA
LockResource
DeleteFileA
Process32FirstW
CloseHandle
RaiseException
GetSystemInfo
CreateThread
LoadResource
FindResourceW
MoveFileExW
GetFileSize
ExitProcess
GlobalMemoryStatusEx
QueryFullProcessImageNameW
lstrcmpiW
GetComputerNameA
SetUnhandledExceptionFilter
MultiByteToWideChar
GetModuleHandleExW
FreeLibrary
TerminateProcess
Sleep
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
shell32
ShellExecuteW
shlwapi
PathRemoveFileSpecW
PathIsPrefixW
PathFileExistsW
AssocQueryStringW
PathFindExtensionW
PathRemoveBackslashW
PathRemoveFileSpecA
PathFindFileNameW
msvcrt
__wgetmainargs
_msize
_XcptFilter
__set_app_type
_wcmdln
?_set_new_mode@@YAHH@Z
_commode
?terminate@@YAXXZ
___lc_codepage_func
wctomb_s
log10
realloc
_clearfp
malloc
_callnewh
_set_fmode
_initterm_e
_initterm
free
_time64
rand
srand
clock
calloc
memcpy
memmove
_amsg_exit
_CxxThrowException
memset
__C_specific_handler
strrchr
wcsrchr
_mbtowc_l
strtol
wcstol
strnlen
wcsnlen
___mb_cur_max_func
tolower
strcpy_s
ceil
_errno
__pctype_func
__CxxFrameHandler3
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ