Static task
static1
Behavioral task
behavioral1
Sample
AnalyzePESig-x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
AnalyzePESig-x64.exe
Resource
win10v2004-20231020-en
General
-
Target
AnalyzePESig-x64.exe
-
Size
158KB
-
MD5
a3d8d9f36f49d8f784ff788fede1bca5
-
SHA1
0c7d61508c3d8e9da19136c6a286c6bfaca38e9f
-
SHA256
621e5cbb5da3991cfe1a70a4591df77a81bd5e1254dbd1570df97c2350493d45
-
SHA512
70dfb7a36b17af79d8d882cb581fe0074fe97054eae2421cc15018f15c900dbf9392acf64380106236326bea79075216d924f3161fe1fb888efa0ca8b1b1063c
-
SSDEEP
3072:/Tsi9UcC86JjbHwCgbuJQxYVaVh65l8RwIMFfb0EgCCdqCMhHV6BeEuEEZO2gUCP:AuUcCRJjbHibuJQxYUVw5l8RwIMlb0EQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AnalyzePESig-x64.exe
Files
-
AnalyzePESig-x64.exe.exe windows:5 windows x64
7aa0c095056d8abad823109095f283b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleW
GetFileSizeEx
GetFileAttributesW
SetFilePointer
FileTimeToLocalFileTime
LocalAlloc
ReadFile
CloseHandle
GetLastError
CreateFileW
GlobalFree
GlobalAlloc
IsDebuggerPresent
GetComputerNameExW
GetLocalTime
GetCurrentProcess
FindClose
FindNextFileW
FindFirstFileW
lstrcmpA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetFileTime
FileTimeToSystemTime
LocalFree
LocalLock
FormatMessageW
InitializeSListHead
RtlCaptureContext
advapi32
CryptHashData
LookupAccountSidW
ConvertSidToStringSidW
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
GetSecurityInfo
shell32
ExtractIconExW
msvcp140
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?uncaught_exceptions@std@@YAHXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
?_BADOFF@std@@3_JB
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Incref@facet@locale@std@@UEAAXXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
wintrust
CryptCATAdminEnumCatalogFromHash
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
crypt32
CertFreeCertificateContext
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CertFindCertificateInStore
CertGetNameStringW
CertNameToStrW
CryptBinaryToStringW
CryptDecodeObject
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
shlwapi
PathFindExtensionW
vcruntime140
__CxxFrameHandler3
__C_specific_handler
__std_terminate
memmove
memcpy
__std_exception_copy
_CxxThrowException
memset
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_wcserror
_invalid_parameter_noinfo_noreturn
terminate
_crt_atexit
_register_onexit_function
_seh_filter_exe
_set_app_type
_errno
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
_set_fmode
_fseeki64
fgetpos
fgetwc
fclose
fsetpos
__p__commode
ungetwc
fputwc
setvbuf
fflush
fgetc
ungetc
fwrite
_wfopen_s
_fileno
_setmode
__acrt_iob_func
__stdio_common_vfwprintf
__stdio_common_vswprintf
__stdio_common_vsnwprintf_s
api-ms-win-crt-string-l1-1-0
wcscpy_s
tolower
strcmp
isspace
strncpy_s
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
calloc
free
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
_itow_s
api-ms-win-crt-math-l1-1-0
log10
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ