Resubmissions
16/10/2023, 15:11
231016-skkg4sbc27 3Static task
static1
General
-
Target
rock_paper_scissors.exe
-
Size
2.3MB
-
MD5
ba24614af867c62203749ea038045c85
-
SHA1
3d21d4b0ed3fcc20fb039b1a63f5cd4f3c6302ab
-
SHA256
96ac9882f07f0deb5d547163519600c11d1d41320b613a739d9f9a1f85607d25
-
SHA512
258b9316a36165d9326887c0149c51fe6dae20a6862402b8c804c4756ffc8c59df3374d229d554b06dabe58025d8a8dba4e87e0a6563888c68b8201fdc935c38
-
SSDEEP
24576:LzugzEvEizfUoUZgp4Oh0zI8eUliRTiKch0lhSMXlIx:LzugYMOfJGpI8e+iR+a4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rock_paper_scissors.exe
Files
-
rock_paper_scissors.exe.exe windows:6 windows x64
fe193b39d697f8cd276b4c8b7b17076e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
timeEndPeriod
timeBeginPeriod
kernel32
GetLastError
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
CreateThread
SetThreadPriority
FreeLibrary
GetProcAddress
LoadLibraryA
WideCharToMultiByte
GetModuleHandleW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
SetThreadExecutionState
MultiByteToWideChar
VerSetConditionMask
FormatMessageW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CloseHandle
WriteFile
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
CreateDirectoryExW
DeviceIoControl
AreFileApisANSI
GetTempPathW
SetFileTime
SetFileInformationByHandle
SetFileAttributesW
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
SetFilePointerEx
ReadFile
GetFileInformationByHandle
CreateFileW
CreateFileA
Sleep
GetModuleFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetSystemTimeAsFileTime
GetStartupInfoW
user32
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetSystemMetrics
EnumDisplayMonitors
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ToUnicode
UnregisterDeviceNotification
RegisterDeviceNotificationW
RegisterRawInputDevices
GetRawInputData
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
CreateIconIndirect
LoadImageW
DestroyIcon
LoadCursorW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
SetRect
ClipCursor
WindowFromPoint
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
RemovePropW
GetPropW
SetPropW
ReleaseDC
GetDC
SetForegroundWindow
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
MapVirtualKeyW
GetKeyState
FlashWindow
GetActiveWindow
SetFocus
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
IsZoomed
BringWindowToTop
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
TrackMouseEvent
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageTime
SendMessageW
PostMessageW
WaitMessage
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
GetLayeredWindowAttributes
SetLayeredWindowAttributes
MoveWindow
gdi32
ChoosePixelFormat
SwapBuffers
SetPixelFormat
DescribePixelFormat
CreateBitmap
CreateRectRgn
DeleteObject
CreateDIBSection
CreateDCW
DeleteDC
GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
shell32
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW
msvcp140
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xbad_function_call@std@@YAXXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
_Query_perf_frequency
_Query_perf_counter
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exceptions@std@@YAHXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1_Locinfo@std@@QEAA@XZ
vcruntime140
strchr
__std_terminate
__std_exception_copy
__current_exception_context
__current_exception
__std_type_info_destroy_list
__C_specific_handler
memcmp
strstr
strrchr
memcpy
memset
memmove
_purecall
_CxxThrowException
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
malloc
realloc
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
__p___argv
exit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_initterm_e
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_initterm
_controlfp_s
__p___argc
_errno
_cexit
_get_initial_narrow_environment
system
terminate
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_set_app_type
api-ms-win-crt-math-l1-1-0
frexp
hypot
ldexp
_fdsign
roundf
fmax
_ldsign
_hypotf
_dsign
fmodf
logf
pow
tan
_dclass
_fdclass
acos
cos
fmod
_ldclass
ceilf
powf
exp
sin
sqrtf
sqrt
sinf
log
round
floorf
fmaxf
fminf
__setusermatherr
cosf
atan2f
fmin
asinf
acosf
ceil
floor
api-ms-win-crt-stdio-l1-1-0
_getcwd
fopen_s
ferror
fgetc
_set_fmode
ungetc
__p__commode
__acrt_iob_func
fclose
ftell
feof
__stdio_common_vsscanf
rewind
_wfopen_s
fgets
fflush
fwrite
fopen
fread
__stdio_common_vsprintf
__stdio_common_vfprintf
fseek
api-ms-win-crt-string-l1-1-0
toupper
tolower
strcspn
strspn
strcmp
strpbrk
strncmp
strncpy
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_chdir
_findnext64i32
_findfirst64i32
_findclose
_stat64i32
_access
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 857KB - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 815B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 373B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ