Static task
static1
Behavioral task
behavioral1
Sample
K8-MS15-010_86(添加用户版).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
K8-MS15-010_86(添加用户版).exe
Resource
win10v2004-20230703-en
General
-
Target
K8-MS15-010_86(添加用户版).exe
-
Size
132KB
-
MD5
cf593ac2420c186dbc537a78f83cd4dc
-
SHA1
bb21bfaf17b8324a49d6f08aedbe2c3d7bec54b1
-
SHA256
f13dcf37bba669b7d4af576f68fad4e6e25df261ccccfb8bf05a752fd5da22ba
-
SHA512
025556501d013b3cede7a6176469b0ef2a1f31a9bdca4068801a094ccdce1f9a3539af9c32b2454505c22800a1f7f7a7a6b4e2e8a30067de9b44d4e055002581
-
SSDEEP
1536:jDKlPUF1I9GndI/AWp/Vyq27DwL4zq+XQuw1Pzry5Tm0KoUhppFmq2:3KUF1oGnC/AtAL9+ghLrwmLoUhlm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource K8-MS15-010_86(添加用户版).exe
Files
-
K8-MS15-010_86(添加用户版).exe.exe windows x86
895fceacc57a3b7ce2c49fdd084ba9f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
LocalFree
GetCurrentProcessId
LoadLibraryA
LocalAlloc
GetProcAddress
GetModuleHandleA
GetVersionExA
ExitProcess
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
SetStdHandle
WriteConsoleW
CloseHandle
HeapSize
SetFilePointer
GetStringTypeW
LCMapStringW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetLocaleInfoW
InterlockedExchange
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
RaiseException
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
LoadLibraryW
RtlUnwind
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
Sleep
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
IsValidLocale
user32
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
SetTimer
FlashWindow
DestroyWindow
PostQuitMessage
KillTimer
DefWindowProcA
keybd_event
DispatchMessageA
shell32
ShellExecuteA
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ