Static task
static1
Behavioral task
behavioral1
Sample
Win11SysCheck.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Win11SysCheck.exe
Resource
win10v2004-20230915-en
General
-
Target
Win11SysCheck.exe
-
Size
1.2MB
-
MD5
21fac66b9b409e72e4ba06e76b86edc9
-
SHA1
4495149973c431407e400f48beecc10322f2ada9
-
SHA256
6dce4b5a26de5cfa04d54ef6564c7b5f6af8faf6e6ef7579c76b8ad34373e118
-
SHA512
57303ad7a000b2ceb9f56566ff8e47f2503dff7c5bd335e9e9d5f519b4cabbae56fa3238e67d830d35ead94c7e571a74e808a428160e13ee84bad314b727064e
-
SSDEEP
12288:dSBEoTNOAyRRgoJlL4Ksk5VvNVqZOCv7PHFv3Hy2EHJLvzGUZONZenudWLPe/OIN:dSyAGGBIPe/T2JCRXff/KjNeri
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Win11SysCheck.exe
Files
-
Win11SysCheck.exe.exe windows:6 windows x64
ed41ea4b83e6e5967aad2e569c527f50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
powrprof
CallNtPowerInformation
wininet
InternetAttemptConnect
InternetGetConnectedState
tbs
Tbsi_GetDeviceInfo
kernel32
GetDiskFreeSpaceExA
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetSystemWindowsDirectoryA
GetNativeSystemInfo
FreeEnvironmentStringsW
GetPhysicallyInstalledSystemMemory
GetProcAddress
LoadLibraryA
SetStdHandle
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetProductInfo
SetEnvironmentVariableW
FindClose
OutputDebugStringW
GetTimeZoneInformation
SetConsoleCtrlHandler
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
HeapSize
CreateFileW
WriteConsoleW
GetActiveProcessorCount
InitializeSListHead
FormatMessageA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlUnwind
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetCurrentThread
CloseHandle
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
user32
GetMonitorInfoA
GetDC
EnumDisplayMonitors
ReleaseDC
gdi32
GetDeviceCaps
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
VariantInit
SysStringLen
VariantClear
advapi32
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
Sections
.text Size: 958KB - Virtual size: 957KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1024B - Virtual size: 546B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ