Static task
static1
Behavioral task
behavioral1
Sample
ss-strings.exe
Resource
win10-20230703-es
Behavioral task
behavioral2
Sample
ss-strings.exe
Resource
win10v2004-20230703-es
General
-
Target
ss-strings.exe
-
Size
25KB
-
MD5
6679c7bad2c3159870527c3bbd3abd0f
-
SHA1
587d1aba714f2c9be82e0554de63563b42ff9352
-
SHA256
736f66305b85b1ff01b735491db3fae966815ba9ae830c3fec1ab750430f5cdf
-
SHA512
e001b997df0e799649d31e9945d9202170d545949ff4013165e3996efc15d2bac3506db76fcdf37f16fd316f2f5e28c2329bace904950afff3e64a8da7893f35
-
SSDEEP
384:TP2FG2VJN3hi3glRGgARmRgSn6LADhMstHQtCTCDpvw1IyOXG7H70q:T+FGPORUWaGhMhCgJyOXG7H70q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ss-strings.exe
Files
-
ss-strings.exe.exe windows x64
4bd808f41e42457b3e1e8539b55ec767
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
PathMatchSpecW
kernel32
FormatMessageW
LocalAlloc
LocalSize
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
OpenProcess
GetLastError
ReadProcessMemory
Module32FirstW
Module32NextW
lstrcmpW
GetFullPathNameA
FindFirstFileA
FindNextFileA
FindClose
GetCurrentProcess
lstrlenW
GetCurrentThreadId
VirtualQueryEx
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
GetCurrentProcessId
advapi32
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
msvcr90
malloc
realloc
??_V@YAXPEAX@Z
fread
strchr
_set_errno
strncpy_s
wcstombs
fopen
__CxxFrameHandler3
_isatty
_fileno
_wtoi
exit
swscanf
_setmode
_amsg_exit
__wgetmainargs
__C_specific_handler
_errno
_exit
_cexit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
strerror
_XcptFilter
fprintf
_CxxThrowException
_fdopen
??_U@YAPEAX_K@Z
free
??3@YAXPEAX@Z
fflush
printf
fwrite
??2@YAPEAX_K@Z
fwprintf
__iob_func
_vsnwprintf
memcpy
sprintf
fclose
msvcp90
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD_K@Z
psapi
GetModuleBaseNameW
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 106B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ