Static task
static1
Behavioral task
behavioral1
Sample
client-2.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
client-2.exe
Resource
win10v2004-20231020-en
General
-
Target
client-2.exe
-
Size
90.7MB
-
MD5
a0367e01d2b25183318a196987a0b313
-
SHA1
b7ae579c2ef8b919644548239cb4764341cb893c
-
SHA256
36e046bda253a51ce8b5dd75dd29d62a6e413d171e2f90657cf6ca4278986ba5
-
SHA512
c9e5a1b554a7cfe5f9ed8967b016211206b65125c8051c1743c723a5f6e68fd061cc033b5a01d7e0bebad2b3b8a6e3f64718ead237acfc56e1f7943cfb392a3a
-
SSDEEP
1572864:7CgR+SwlR7yddKIh0z5MhQLx9V0CtEawqmWCvJuUByY/Wdc7nUwod5V941KK0DlL:7fyRxJzSeLx99ua/2Mqa66V9dK0DA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource client-2.exe
Files
-
client-2.exe.exe windows:6 windows x86
74d3ac7fa94bff4a954302bdae21e424
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadStackGuarantee
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
lstrlenW
SetFileTime
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WaitForSingleObject
FlushFileBuffers
MultiByteToWideChar
WriteConsoleW
GetModuleHandleW
FormatMessageW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetTempPathW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
HeapSize
AddVectoredExceptionHandler
CreateDirectoryW
FindFirstFileW
FindClose
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
AcquireSRWLockExclusive
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetLastError
CreateNamedPipeW
ReadFileEx
SleepEx
WriteFileEx
SetLastError
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
GetFinalPathNameByHandleW
CreateSymbolicLinkW
CreateHardLinkW
SetFilePointerEx
SetFileInformationByHandle
SetFileAttributesW
LCMapStringW
CompareStringW
GetFullPathNameW
CloseHandle
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
RaiseException
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
ntdll
RtlNtStatusToDosError
NtWriteFile
NtReadFile
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
Sections
.text Size: 255KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90.4MB - Virtual size: 90.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ