Static task
static1
Behavioral task
behavioral1
Sample
MS10-048-x64.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
MS10-048-x64.exe
Resource
win10v2004-20230703-en
General
-
Target
MS10-048-x64.exe
-
Size
25KB
-
MD5
f43f7ce8da5d79ab452be491366b48cb
-
SHA1
418bec3493c85e3490e400ecaff5a7760c17a0d0
-
SHA256
ec617330c1f6460aac0b91d7251fc325a77d05edd13dd3e7154c2609958e0035
-
SHA512
15d0243afa61c4c1f5a432ee26aec2178301f54a3a15e96c573f5fd8deccee6c9c30ecd9c067c20a295383674b1c88d3dde1f53d9a5e830788ee1e3abb269807
-
SSDEEP
384:2C1bleJGyXIDWuOqHiBAfBWC5VP3yiRMoJlMyW8udTA1mNN3bbgune6RAFjZP:fAEysdRHE+oCLP3yiRMoJlWvhneLF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MS10-048-x64.exe
Files
-
MS10-048-x64.exe.exe windows x64
00856a5e5e44dccbbe7870c36bcbd522
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateProcessA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
_strdup
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_exit
_fmode
_initterm
_lock
_onexit
_strnicmp
_unlock
abort
calloc
exit
fflush
fgets
fopen
fprintf
free
fwrite
malloc
memcpy
memset
printf
putchar
puts
raise
signal
sprintf
strlen
strncmp
vfprintf
user32
CallNextHookEx
CreateWindowExA
DestroyWindow
MessageBoxA
SetWindowsHookExA
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE