Static task
static1
General
-
Target
c284505447b8529fdd468e13f149582f5083cf442733bfb7bdebf66d38476f20
-
Size
3.5MB
-
MD5
c9abc0932559d7ecced02a9125acea05
-
SHA1
2f449790415a4b7a2a4297e20169c6457b851863
-
SHA256
c284505447b8529fdd468e13f149582f5083cf442733bfb7bdebf66d38476f20
-
SHA512
722049ff5d0c3a16fede1d643d97ba76a7775c32586a8d53b20950e809dbcc716b76a65917c87d52916a29e157c0cbad0bc9a132d15bc3a8b695cfe306e08b13
-
SSDEEP
98304:TMOl82OGyTIZ+e9KsPdJDrL6R2tcya1luLIlMCABHQ:T9l82skVxEGcya1lVKQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c284505447b8529fdd468e13f149582f5083cf442733bfb7bdebf66d38476f20
Files
-
c284505447b8529fdd468e13f149582f5083cf442733bfb7bdebf66d38476f20.exe windows:6 windows x64
847c2f25b48889c8545823bcf35ae6ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
kernel32
CreateFileW
RtlVirtualUnwind
Sleep
LoadLibraryA
GetProcAddress
VirtualProtect
GetProcessHeap
HeapAlloc
HeapFree
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
GetCurrentThread
HeapReAlloc
GetCurrentProcess
CloseHandle
GetModuleHandleA
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
SetLastError
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockExclusive
GetEnvironmentVariableW
AcquireSRWLockShared
ReleaseSRWLockShared
FreeLibrary
SetFilePointerEx
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlPcToFileHeader
WriteFile
GetModuleFileNameW
ExitProcess
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
psapi
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModulesEx
oleaut32
SafeArrayCreateVector
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SysStringLen
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayGetLBound
GetErrorInfo
SysFreeString
ntdll
NtWriteFile
RtlNtStatusToDosError
Sections
.text Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ