Static task
static1
Behavioral task
behavioral1
Sample
shell.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
shell.exe
Resource
win10v2004-20230703-en
General
-
Target
shell.exe
-
Size
254KB
-
MD5
5d9732b7c696249b94368b65abf71460
-
SHA1
aa83fcf172d91b71f060f0c3b3ec476f077da397
-
SHA256
487efcdcab91e89c521c2995e3bb1449c618c4886f2198e85d08573dda020f70
-
SHA512
84fbe1c9ee8fa1a11c19742a2817bf8de30c79af7d360d49fbdacc562f633eb156399df5b7fffa4f0782027d23842d8d6b9579ae3423cce584c25bd7b6730d98
-
SSDEEP
6144:RzvZcjyq7AMrjWfB9ihYZwwGRhqbzC6B4:hvoxEeKBUxFmOD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource shell.exe
Files
-
shell.exe.exe windows x64
018174f4d6bec6696dc4346b6dee0e57
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetCurrentThread
SetFilePointerEx
AcquireSRWLockExclusive
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
ReleaseSRWLockShared
GetStdHandle
GetCurrentProcessId
WaitForSingleObject
UnmapViewOfFile
TryAcquireSRWLockExclusive
QueryPerformanceCounter
RtlLookupFunctionEntry
HeapFree
ReleaseMutex
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
CreateMutexA
GetModuleHandleA
GetFileInformationByHandle
GetFileInformationByHandleEx
GetConsoleMode
ReleaseSRWLockExclusive
GetCurrentThreadId
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
GetProcessHeap
MapViewOfFile
MultiByteToWideChar
WriteConsoleW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
CreateFileMappingW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
HeapAlloc
CreateFileW
CreateProcessA
WriteProcessMemory
GetProcAddress
LoadLibraryA
CloseHandle
IsProcessorFeaturePresent
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ntdll
NtReadFile
NtCreateThreadEx
NtProtectVirtualMemory
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtReadVirtualMemory
NtWaitForSingleObject
NtWriteFile
RtlNtStatusToDosError
psapi
GetModuleBaseNameW
EnumProcessModulesEx
vcruntime140
__C_specific_handler
memmove
memset
memcmp
memcpy
__CxxFrameHandler3
_CxxThrowException
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Sections
.text Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 97B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ