Static task
static1
Behavioral task
behavioral1
Sample
T00ls-MS15-010_64(自定义参数版).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
T00ls-MS15-010_64(自定义参数版).exe
Resource
win10v2004-20230703-en
General
-
Target
T00ls-MS15-010_64(自定义参数版).exe
-
Size
11KB
-
MD5
383e792703003fa8fb4295ff060a2faa
-
SHA1
24f7190e4b6be7df3f80fbd8d5e20ac7b72116b0
-
SHA256
5e3935ca4cbc72737ee574ef4031919bceebd2d4d0a636225f87352d2cea6c89
-
SHA512
d5c7c613c92addfa81d91d284f5519e9f588ab741f6d6bbaa83c7fe809e595b85a92f47e4e8b96e8ca0255278adbcdf7d2691408b2d1043d40c0db701db907ae
-
SSDEEP
192:1/jPcSZRHodWMbPRrLcPKO/s4am407SiYaEPQN6:ljPBo5DOC507Si5m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource T00ls-MS15-010_64(自定义参数版).exe
Files
-
T00ls-MS15-010_64(自定义参数版).exe.exe windows x64
77161a21e0717d3e3536be776e3e3ae6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
LocalFree
GetCurrentProcessId
LoadLibraryA
LocalAlloc
GetProcAddress
GetModuleHandleA
GetVersionExA
ExitProcess
ReadFile
CloseHandle
CreateProcessW
GetStartupInfoW
CreatePipe
GetCommandLineW
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
GetSystemTimeAsFileTime
user32
FlashWindow
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostQuitMessage
KillTimer
DefWindowProcA
keybd_event
SetTimer
shell32
CommandLineToArgvW
msvcr90
exit
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_fmode
_commode
strcpy_s
strstr
puts
wprintf
printf
_amsg_exit
__getmainargs
_XcptFilter
_exit
_cexit
__C_specific_handler
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ