Static task
static1
Behavioral task
behavioral1
Sample
Msmpeges.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Msmpeges.exe
Resource
win10v2004-20230703-en
General
-
Target
Msmpeges.bin.zip
-
Size
76KB
-
MD5
5cf28ec0420b45117d3373bb19e5604e
-
SHA1
694351f4adf647a2d33bde95b8e2f2b7b3ebec7e
-
SHA256
eb29fced033ea67608e939b173704b856db3fe680fce51b06c85bb99b25dad9d
-
SHA512
543c07659e8e994b22982a8cfe72bd55d6d1082c045e863635ca2638de617e2c9a3f8a7f2e8b6b6c6cf5f636852200b02c069cede39c59b2f0b0f840fc2b63ee
-
SSDEEP
1536:M3uo1g0iS/HVj9cliots6vYyDEAIeZmwTQH01Jn629D6GgTyz6j6JEh1j39+zqwz:GJeSvfcliothFHaOr9D68umyh1jGqwz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Msmpeges.bin
Files
-
Msmpeges.bin.zip.zip
Password: infected
-
Msmpeges.bin.exe windows x86
Password: infected
3a9d8d3df56e44da448e2fafa92efb25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
ExitProcess
GetModuleHandleW
GetConsoleWindow
SetConsoleCursorPosition
AllocConsole
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindFirstVolumeW
FindNextFileW
GetFinalPathNameByHandleW
WaitForMultipleObjects
SetThreadPriority
GetQueuedCompletionStatus
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
GetCurrentThread
GetSystemInfo
WriteConsoleW
TerminateProcess
SetVolumeMountPointW
SetFilePointerEx
LocalFree
MoveFileExW
FindVolumeClose
GetCurrentProcessId
SetThreadExecutionState
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
HeapCreate
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
SetStdHandle
ScrollConsoleScreenBufferW
GetNativeSystemInfo
GetLastError
Sleep
OpenProcess
ReleaseMutex
WaitForSingleObject
CreateMutexW
LoadLibraryW
SetProcessShutdownParameters
GetStdHandle
GetCommandLineW
GetCurrentProcess
SetPriorityClass
GetConsoleScreenBufferInfo
ReadFile
DeleteCriticalSection
GetLocalTime
CloseHandle
lstrcatW
CreateFileW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
CreateThread
LCMapStringW
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetFileType
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetACP
RaiseException
user32
wsprintfA
wsprintfW
ShowWindow
advapi32
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shell32
SHEmptyRecycleBinW
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantClear
SysAllocString
VariantInit
rstrtmgr
RmStartSession
RmGetList
RmRegisterResources
RmEndSession
shlwapi
PathRemoveFileSpecW
PathFindExtensionW
StrStrIW
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ