Static task
static1
Behavioral task
behavioral1
Sample
wintail.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
wintail.exe
Resource
win10v2004-20230703-en
General
-
Target
wintail.exe
-
Size
74KB
-
MD5
2e79909bb6212d95a6149535ea8ea36d
-
SHA1
dc32a0b30a3f28c87450c87a7e8af63f9282a1f7
-
SHA256
a9a1931b3dcfc1406c4410ed0ff2eab291a37f3d724f6b1f9f789d838fcf028c
-
SHA512
12f023bd391d311e9d6b0cd543f17d8f62ea58fa6c1b6e03e8121dfbc0e213632bf94c3220c4297b4c7a1c8fecfb9664decd5f0398d98f00437e3ca860ae38a1
-
SSDEEP
1536:HKJpomswqZSjIhv/A0EpgcRTShAzsWjcdm5Om:1Gi/A0evUA8m5Om
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wintail.exe
Files
-
wintail.exe.exe windows x86
3a9434f58b239851f54aee3bd703bbf0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Wow64DisableWow64FsRedirection
Sleep
EnterCriticalSection
LeaveCriticalSection
ReadFile
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
GetFileType
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
HeapFree
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
SetFilePointer
SetFilePointerEx
ReadConsoleW
GetStdHandle
GetStartupInfoW
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetModuleFileNameW
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CreateFileW
CloseHandle
WriteConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
HeapAlloc
HeapReAlloc
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
SetEndOfFile
GetStringTypeW
HeapSize
LCMapStringW
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ