Static task
static1
Behavioral task
behavioral1
Sample
body.exe
Resource
win7-20231023-en
General
-
Target
body.pif
-
Size
136KB
-
MD5
6d931ecd3efbfd87240df8c6327d33d9
-
SHA1
0829fec98ef8659dc9504e19478de2655cd9919f
-
SHA256
0707641055d793e08592a8249603f4b60a1b3474cb8a01af8801e6cb5973ae7e
-
SHA512
304103c99fd22615fa3d9fc804ba5686a474fcfd66bb84b309f05652630ee370ca82bf9b3790e7526f66262877f272e1b96e264c6df3d48192451c4110cf4ccc
-
SSDEEP
1536:Zm8cmmZ/BqygfVsQjg6XRaXFqOXcJ3KusWjcddUo8qf+H8PmbDusX7qjh3rmKPNP:gzmm14dZhFOvx3+cObDusGjZqMNp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource body.pif
Files
-
body.pif.exe windows:5 windows x86
de90c3d6c356eaf58b2b81e11c57a668
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetLocalTime
LoadLibraryA
GetModuleHandleA
CloseHandle
ExitProcess
CreateFileA
GetSystemTimeAsFileTime
WriteFile
Sleep
GetSystemDirectoryA
lstrcatA
ExitThread
GetLastError
GetModuleFileNameA
GetTempPathA
DeleteFileA
CreateThread
lstrcpyA
lstrcmpA
lstrcpynA
HeapAlloc
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetProcessHeap
lstrcmpiA
GlobalFree
GetFileSize
GlobalAlloc
ReadFile
GetTempFileNameA
MapViewOfFile
UnmapViewOfFile
GetQueuedCompletionStatus
GetCurrentThread
GetDriveTypeA
SetThreadPriority
FindFirstFileA
CreateFileMappingA
PostQueuedCompletionStatus
FindNextFileA
CreateIoCompletionPort
SetFilePointer
GetSystemTime
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
WideCharToMultiByte
GetTickCount
WaitForSingleObject
HeapFree
lstrlenA
CreateFileW
HeapReAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
EncodePointer
DecodePointer
RaiseException
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
user32
wvsprintfA
CharUpperBuffA
CharUpperA
CharLowerA
wsprintfA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
ws2_32
sendto
recv
ntohs
closesocket
gethostbyname
htons
select
inet_addr
send
connect
socket
WSAStartup
Sections
.text Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ