Static task
static1
Behavioral task
behavioral1
Sample
coder.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
coder.exe
Resource
win10v2004-20230703-en
General
-
Target
d8106bd51d871f04952335fedef6ca695cc56d257a537a9d11d5ed119e1a2c2b
-
Size
24KB
-
MD5
8b9f21e7e85080c030acafe8ad804443
-
SHA1
ebc0fb34318f064ce1db29d1e90cced75008181d
-
SHA256
d8106bd51d871f04952335fedef6ca695cc56d257a537a9d11d5ed119e1a2c2b
-
SHA512
60b773faaf9ceeb9db8e3e7479554e3e002e6048ef000617185b3da332422da0b7d3da5c38c99a88d572b317c6973a5920c1e032d82336fe3b7661f1ac146687
-
SSDEEP
768:iuGdBkpNAwwiIPWX4rC+r+VZHENtupo8dHF9MeKmvSaSK:idfknAyL1+r+VIw28tFyaSK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/coder.exe
Files
-
d8106bd51d871f04952335fedef6ca695cc56d257a537a9d11d5ed119e1a2c2b.rar
-
coder.RES
-
coder.asm
-
coder.exe.exe windows x86
0f2a450a9727d35e070f8afb35da28bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowRect
GetSystemMetrics
MessageBoxA
SetWindowPos
GetDC
wsprintfA
kernel32
CreateFileMappingA
CreatePipe
CreateProcessA
ExitProcess
GetCommandLineA
GetConsoleMode
GetFileAttributesA
GetFileSize
GetLastError
GetProcessHeap
GetStdHandle
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
CreateFileA
HeapDestroy
HeapFree
MapViewOfFile
MultiByteToWideChar
ReadConsoleA
ReadFile
RtlZeroMemory
SetConsoleMode
SetFilePointer
TerminateProcess
UnmapViewOfFile
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpiA
lstrlenA
CloseHandle
HeapCreate
advapi32
CryptCreateHash
CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptGetHashParam
CryptAcquireContextA
ntdll
RtlComputeCrc32
gdi32
GetDeviceCaps
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
coder.obj
-
coder.rc