Static task
static1
Behavioral task
behavioral1
Sample
2023.10.14资金统计余额.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2023.10.14资金统计余额.exe
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
2023.10.14资金统计余额.exe
Resource
win10v2004-20231023-en
General
-
Target
2023.10.14资金统计余额.bat
-
Size
71KB
-
MD5
0ec51612b0644a0ead7cf84858356ce5
-
SHA1
325a569a7b87c9497f908c30b20917d85b1a3f46
-
SHA256
91bfa9934f6554959ee5e014e6952ca9e7ac3ace1d86705aa283ba908e61098f
-
SHA512
20820889f428357690218e269fb381b2843ec314a9593f60d460449cb5df19fa6720f4af46a582d00b491c1d2d5e3f1aa9ec0d3a426a78537b04ec620797afe3
-
SSDEEP
1536:4DVHr0O6epVQk5urWtCTKY7kw4NTDvu60pNYHxuw5B7:4DVH4O6e3b5urCo4N26eNYHxf5B7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023.10.14资金统计余额.bat
Files
-
2023.10.14资金统计余额.bat.exe windows:5 windows x64
Password: infected
fbec566bf9397c9e9dddf6c71cd3c659
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ConvertThreadToFiber
GetTimeZoneInformation
VirtualProtect
CreateFiber
SwitchToFiber
CloseHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapAlloc
GetCommandLineA
GetLastError
HeapFree
RaiseException
RtlPcToFileHeader
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
WideCharToMultiByte
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
HeapReAlloc
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
CreateFileA
winhttp
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ