Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume2/Windows/fonts/win/osk.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume2/Windows/fonts/win/osk.exe
Resource
win10v2004-20230703-en
General
-
Target
osk.exe
-
Size
175KB
-
MD5
734f98655182bbba246a2f937bf86d92
-
SHA1
7f0c0aaa7df48f2d4bea77da6fdd84f96f383554
-
SHA256
534c19822fae1f640f150f42e76ace3fc537f87e698173e326ab9382efc9fdd3
-
SHA512
5e5e720a99bc6e22681c65f061320e7e140c9470f9a54f2435a0a01c15733128acd9c40d347b76fa9e918224958d43fe8a3e61c6db11057d47356044fdf788c2
-
SSDEEP
3072:Iv5wypRmI8wi0NUF/6kLmFJhnZgd1D0SgepMzkcNEooTjudCRDr0J2krTN/Di:IWo8wi0a70zy1D0S9Mzk8Pey2iTpi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume2/Windows/fonts/win/osk.exe
Files
-
osk.exe.zip
Password: S@ndb0x!2023@@
-
Device/HarddiskVolume2/Windows/fonts/win/osk.exe.exe windows x86
Password: S@ndb0x!2023@@
18e3eac3e047c2416ca9a716d742272f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathUnquoteSpacesW
PathFindExtensionW
kernel32
CreateThread
SetHandleInformation
CreatePipe
DuplicateHandle
GetCommandLineW
TlsAlloc
GetProcessTimes
OpenProcess
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GenerateConsoleCtrlEvent
SetConsoleCtrlHandler
GetExitCodeProcess
Process32NextW
Process32FirstW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
DeleteCriticalSection
UnregisterWait
WaitForSingleObject
LeaveCriticalSection
SetWaitableTimer
EnterCriticalSection
ResumeThread
SetProcessAffinityMask
RegisterWaitForSingleObject
GetSystemTimeAsFileTime
CreateWaitableTimerW
InitializeCriticalSection
ReadFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapSize
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
VirtualAlloc
HeapReAlloc
GetTickCount
QueryPerformanceCounter
VirtualFree
SetLastError
HeapCreate
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetFileInformationByHandle
Sleep
SystemTimeToFileTime
CloseHandle
CompareFileTime
FileTimeToSystemTime
MoveFileW
GetSystemTime
CreateFileW
SetFilePointer
SetEndOfFile
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
GetProcessAffinityMask
FindResourceExW
LoadResource
GetModuleHandleW
LocalFree
TlsGetValue
LocalAlloc
TlsSetValue
GetUserDefaultLangID
FormatMessageW
GetModuleFileNameW
CreateProcessW
TerminateProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
AllocConsole
SetConsoleTitleW
GetStdHandle
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
GetConsoleWindow
GetCurrentProcessId
FreeConsole
GetProcessHeap
HeapAlloc
GetComputerNameW
HeapFree
GetLastError
GetCurrentThreadId
TlsFree
IsValidCodePage
MultiByteToWideChar
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetModuleFileNameA
user32
EnumWindows
PostThreadMessageW
PostMessageW
LoadImageW
SetWindowLongW
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
PostQuitMessage
ShowWindow
SetFocus
GetWindowLongW
CheckRadioButton
SetWindowPos
SetDlgItemInt
SetDlgItemTextW
SendMessageW
GetDlgItemTextW
GetDlgItem
EnableWindow
GetDlgItemInt
SendDlgItemMessageW
GetWindowRect
GetDesktopWindow
MoveWindow
CreateDialogIndirectParamW
MessageBoxW
MessageBoxIndirectW
GetSystemMenu
EnableMenuItem
GetWindowThreadProcessId
GetSystemMetrics
comdlg32
GetOpenFileNameW
advapi32
CreateServiceW
StartServiceW
ControlService
SetServiceStatus
DeleteService
QueryServiceConfig2W
ChangeServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW
OpenServiceW
GetServiceKeyNameW
EnumServicesStatusW
OpenSCManagerW
QueryServiceStatus
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
StartServiceCtrlDispatcherW
AllocateAndInitializeSid
CheckTokenMembership
RegDeleteValueW
IsTextUnicode
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetServiceDisplayNameW
CloseServiceHandle
LsaEnumerateAccountRights
LsaAddAccountRights
FreeSid
LsaLookupSids
LsaClose
LsaLookupNames
LsaFreeMemory
IsValidSid
GetSidSubAuthorityCount
GetSidLengthRequired
GetSidIdentifierAuthority
InitializeSid
GetSidSubAuthority
LsaOpenPolicy
LsaNtStatusToWinError
RegisterServiceCtrlHandlerExW
shell32
ShellExecuteExW
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 325KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json