Static task
static1
Behavioral task
behavioral1
Sample
gotoo.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
gotoo.exe
Resource
win10v2004-20230915-en
General
-
Target
gotoo.exe
-
Size
922KB
-
MD5
1d88f0cf09e1c2e3ff0e251629a72f69
-
SHA1
f1550eef8ca09d4c221f579a1edbd7a991980c03
-
SHA256
83c0373ead1fb79f86f741e577f7018019495702c361ef55c4a53510346c8757
-
SHA512
39f119fcb4eb73a07e9f129dc68332c09decff83d288d27b1da0fb736e91f7c0bfbb1d65de18ce9733a1bdeb1ba3e8fc9e6f19fbdff778616970ece9ffed488d
-
SSDEEP
24576:uMoFUXBkMY+RqBOHx5E7DYuM7M4QoD8/vAcX5D5Xeb3SdSHzT4k1BfaBcRKOKnoJ:OFUXBkMY+RqBOHx5E7DYuSM4QoD8/T5K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gotoo.exe
Files
-
gotoo.exe.exe windows x86
39ce0a1582caf9f48f9f2f1d1b83e0c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentThread
GetCurrentProcess
GetCommandLineW
DuplicateHandle
GetCurrentDirectoryW
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
CompareStringOrdinal
ReleaseSRWLockShared
FindClose
ReleaseMutex
FreeEnvironmentStringsW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
TerminateProcess
GetNumberOfConsoleInputEvents
TryAcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
HeapAlloc
HeapFree
ReadConsoleInputW
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetFileInformationByHandle
GetFileInformationByHandleEx
WriteConsoleW
FindFirstFileW
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetFileType
SetConsoleTextAttribute
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
GetProcessHeap
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
SetConsoleMode
MultiByteToWideChar
CreateThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetSystemTimeAsFileTime
GetConsoleScreenBufferInfo
CreateFileW
GetStdHandle
TlsGetValue
GetProcAddress
GetModuleHandleA
RtlCaptureContext
TlsSetValue
Sleep
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleCursorPosition
SetConsoleCursorInfo
WaitForMultipleObjects
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
IsProcessorFeaturePresent
user32
GetWindowThreadProcessId
ToUnicodeEx
GetKeyboardLayout
GetForegroundWindow
advapi32
SystemFunction036
ntdll
RtlNtStatusToDosError
NtReadFile
NtWriteFile
bcrypt
BCryptGenRandom
vcruntime140
__CxxFrameHandler3
memcpy
_except_handler4_common
__current_exception_context
__current_exception
_CxxThrowException
memset
memmove
memcmp
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
_exit
exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
terminate
_set_app_type
_initialize_onexit_table
_initterm
_register_onexit_function
_crt_atexit
_controlfp_s
_seh_filter_exe
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Sections
.text Size: 699KB - Virtual size: 698KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 198KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ