Static task
static1
Behavioral task
behavioral1
Sample
write.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
write.exe
Resource
win10v2004-20230703-en
General
-
Target
write.exe
-
Size
11KB
-
MD5
73e19be0e0ecd88616b5762f621b0226
-
SHA1
27cdeb38a55826936d5b55f54984447398c5d996
-
SHA256
e559c2673d312a0089d8dcdfaecd7fe261f74aaaf02a110722b34a0c85574012
-
SHA512
eab88674f7b27fae21bd2d0f4f3cdd391e56bc5fc9135363b8b1a05a8660d41518e6382c67094a76ef10ee9fcd49e46f6b3164843a0581eb5ec1b032d4fe775f
-
SSDEEP
192:fPgFa6DLjHpB+tH+r9eKY03hWxu/MWYOWS:w1Ljb+Byewoxu/MWYOWS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource write.exe
Files
-
write.exe.exe windows x64
6ccc14aa5f1a410f31748d8ad9f362fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
ShellExecuteW
kernel32
TerminateProcess
SetUnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
Sleep
msvcrt
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ