Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230712-en
General
-
Target
file.exe
-
Size
411KB
-
MD5
1209c6857cc79e40556ce90da185c356
-
SHA1
4f58e0d124edf610c0554483443cf38b4cc682a3
-
SHA256
ee5754e39b22b6758e5d2b940a0cfc11835a80779073148028a6222a7e37e086
-
SHA512
b0831e6344d6ff1eafa1e4937eae5206c9e99425ff4ec222800011dbc1c74eebbc81818b1fd6c71f8530de1cf24a15e83454dc36d37b025f57fadfbd14bb0376
-
SSDEEP
6144:LpFd4439vvCgXcn77/2Fzdm9u6tCp58B3I99RArUNOMSYZW/t:LpD39vCoc//wxmo6te5oyLyCOq4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource file.exe
Files
-
file.exe.exe windows x86
6e9c6ac87a49785649f7750be9f53326
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
SetDefaultCommConfigA
SetInformationJobObject
AllocConsole
GetConsoleAliasExesLengthA
UpdateResourceA
MoveFileExW
InterlockedDecrement
WaitNamedPipeA
GetCurrentProcess
SetConsoleActiveScreenBuffer
GetNamedPipeHandleStateA
GetProfileStringW
GetUserDefaultLCID
SetComputerNameW
GetTimeFormatA
_lclose
_lcreat
GetModuleHandleW
GetConsoleAliasesLengthA
GetWindowsDirectoryA
GetCompressedFileSizeW
GetConsoleAliasExesW
EnumTimeFormatsA
GetDriveTypeA
GlobalAlloc
GetPrivateProfileIntA
LoadLibraryW
TerminateThread
FatalAppExitW
_hread
GetPrivateProfileStructW
GetCalendarInfoW
SetConsoleCP
DeleteVolumeMountPointW
GetFileAttributesA
TransactNamedPipe
GetConsoleAliasW
GetStartupInfoW
GetComputerNameA
VirtualUnlock
SetCurrentDirectoryA
GetLastError
IsDBCSLeadByteEx
GetCurrentDirectoryW
SetLastError
BackupRead
GetProcAddress
VirtualAlloc
HeapSize
CreateNamedPipeA
MoveFileW
GlobalGetAtomNameA
LoadLibraryA
InterlockedExchangeAdd
OpenWaitableTimerW
LocalAlloc
BuildCommDCBAndTimeoutsW
GetNumberFormatW
GetCurrentConsoleFont
EnumDateFormatsA
CreateIoCompletionPort
_lread
GetModuleHandleA
FreeEnvironmentStringsW
FindNextFileW
OpenSemaphoreW
SetFileShortNameA
ReadConsoleInputW
LocalSize
FindFirstVolumeW
DeleteFileW
ReadConsoleOutputCharacterW
EnumSystemLocalesW
DeleteFileA
CloseHandle
ReadFile
WriteConsoleW
CreateMailslotW
GetCommandLineW
LCMapStringW
FlushFileBuffers
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MoveFileA
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
HeapSetInformation
RtlUnwind
HeapCreate
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
ExitProcess
WriteFile
GetModuleFileNameW
SetFilePointer
RaiseException
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
MultiByteToWideChar
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW
user32
CharUpperA
CharUpperBuffA
advapi32
RevertToSelf
winhttp
WinHttpGetProxyForUrl
Sections
.text Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 174KB - Virtual size: 30.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ