Static task
static1
Behavioral task
behavioral1
Sample
K8-MS15-010_64(本地测试版).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
K8-MS15-010_64(本地测试版).exe
Resource
win10v2004-20230703-en
General
-
Target
K8-MS15-010_64(本地测试版).exe
-
Size
143KB
-
MD5
cf32ebc23d938e5bbce496c6a5b358f7
-
SHA1
24703e7bba128f4a687a4db8a7e649b9328a08a9
-
SHA256
a311ac9da076c45395deea719eac07176270da8c5d4d23cfc478de46c3a3da7d
-
SHA512
2c9be109a1bb53cdab3a19cdea0a276278026159188ffc7499c1ea25270a6a89d23f8eb92a1130225403fbf24856067cf4cbde4e752b352f9f31eee8346feb95
-
SSDEEP
3072:PSubG93X7MT7hspvAoh8NYjZ8FFHlUw1gqSIk:PShH7MTWpvAomNlLHRS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource K8-MS15-010_64(本地测试版).exe
Files
-
K8-MS15-010_64(本地测试版).exe.exe windows x64
0884cc6a205d703907f2b8fe70f38c0e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
LocalFree
GetCurrentProcessId
LoadLibraryA
LocalAlloc
GetProcAddress
GetModuleHandleA
GetVersionExA
ExitProcess
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
SetStdHandle
WriteConsoleW
CloseHandle
HeapSize
SetFilePointer
GetStringTypeW
LCMapStringW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetLocaleInfoW
SetConsoleCtrlHandler
GetCommandLineA
GetStartupInfoW
RtlUnwindEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
RaiseException
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
GetCurrentThread
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
Sleep
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsValidLocale
user32
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
SetTimer
FlashWindow
DestroyWindow
PostQuitMessage
KillTimer
DefWindowProcA
keybd_event
DispatchMessageA
shell32
ShellExecuteA
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ