Static task
static1
Behavioral task
behavioral1
Sample
paping.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
paping.exe
Resource
win10v2004-20230915-en
General
-
Target
paping.exe
-
Size
576KB
-
MD5
aa32a25fa1fa895f7ab709b88349c933
-
SHA1
262c93b6178067b75e51df304c612b9034a9eef4
-
SHA256
a54eaa578af16919b4a582c687da350038db018a9748f9a0ee3c4a5c01af9bd2
-
SHA512
bf719b1b61faa6ec937069d67b111b8eff317f40e2617bac08240da8355614ef38d26b4651a700ce49a6780ce37a21dd253809e040ce63de25d177260822d19b
-
SSDEEP
12288:jSFb5ouUGUeLrDRcNWSWbOZxnBht96gXmU:jCeXclIWDb+Bht9M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource paping.exe
Files
-
paping.exe.exe windows:5 windows x86
4a32289c717ca08ae1a68891867495da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTimeAsFileTime
Sleep
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
SetEnvironmentVariableA
CompareStringW
SetStdHandle
VirtualQuery
GetProcessHeap
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
OutputDebugStringW
WriteConsoleW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
InterlockedCompareExchange
RtlUnwind
RaiseException
HeapValidate
IsBadReadPtr
GetTimeZoneInformation
GetLastError
SetConsoleCtrlHandler
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCPInfo
LCMapStringW
lstrlenA
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetCurrentThread
InitializeCriticalSectionAndSpinCount
FatalAppExitA
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
WriteFile
FreeLibrary
GetLocaleInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FlushFileBuffers
CloseHandle
OutputDebugStringA
CreateFileW
ws2_32
socket
htons
ioctlsocket
connect
select
closesocket
__WSAFDIsSet
WSAStartup
gethostbyname
WSACleanup
inet_ntoa
Sections
.textbss Size: - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 456KB - Virtual size: 455KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ