Static task
static1
Behavioral task
behavioral1
Sample
getlsasrvaddr.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
getlsasrvaddr.exe
Resource
win10v2004-20230915-en
General
-
Target
getlsasrvaddr.exe
-
Size
49KB
-
MD5
fce775d0d5e08b8a55770be4462890f7
-
SHA1
bfdb5c49a4757fee004c93390623d58983904782
-
SHA256
ece925f85dc15b816dacacbb92ad41045f0cc58c2e10c5d3b66723ae11cf65c8
-
SHA512
7a6e84cd756a727d011e2cdda8c8dde7965ae69490fc3e4cd0cfb37f7087bc27b7a5d9b2995f6813b7e3d40634d3e7146b985eb111c303a495e5f2cff10df2b7
-
SSDEEP
768:Mx0BEts1qnYqCU8H+OuQ1nNWTT/QsUh8vmOjDPk/fED6n9+8HykBYWWRuKKKKKK7:C0BYs1UPpu1OTP08OOvPsHHxy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource getlsasrvaddr.exe
Files
-
getlsasrvaddr.exe.exe windows:5 windows x86
4613e10bbbccfa307fce275d042a96af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
SymInitialize
SymLoadModuleEx
SymFromName
SymUnloadModule64
SymCleanup
shell32
SHFileOperationA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
advapi32
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptAcquireContextA
kernel32
SetStdHandle
GetStringTypeW
WriteConsoleW
LCMapStringW
FlushFileBuffers
CreateFileW
MultiByteToWideChar
DeleteFileA
GetCurrentProcess
FreeLibrary
CreateFileA
LoadLibraryExA
LoadLibraryA
FindClose
FindFirstFileA
SetFilePointer
CloseHandle
ReadFile
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
GetConsoleCP
GetConsoleMode
HeapSize
HeapReAlloc
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ