Static task
static1
General
-
Target
1.txt
-
Size
964KB
-
MD5
23e21f1920c6caba9efd15ac23e0d1ca
-
SHA1
2dd0fed97ec7f35e40966cb3446b510b98aa041e
-
SHA256
47e63b6a334a54c0e1f51f3fef3a06afbfd45e618324cc3740f1f9c40f63a9db
-
SHA512
195cef6de8fa5d95644487b80f710d798da25435717530fc58fd2a9cc1692ef14d1ba1eebfc4e4ca0a572def6c5ae16d42b260390504e148d5a31462e73de9ac
-
SSDEEP
12288:lbFF/EVJLxj9aKgRUY60Zwz6FTfn/xI0QFYWLx6LrYcJSVN:lB9EVNmKCUY6kJh/u0Q+WLx6hA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.txt
Files
-
1.txt.dll windows:6 windows x86
a074e547dafab8ff20635e72c4f27088
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
FreeLibrary
ReadFile
SetLastError
GetCurrentProcess
GetFileAttributesW
MultiByteToWideChar
GetLastError
GlobalFlags
GetSystemInfo
CreateProcessW
WideCharToMultiByte
VirtualQuery
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetQueuedCompletionStatus
ResetEvent
GetSystemTimeAsFileTime
HeapDestroy
HeapSize
PostQueuedCompletionStatus
SetEndOfFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
QueryDosDeviceW
LCMapStringW
CompareStringW
ReadConsoleW
GetFileSizeEx
GetFileType
GetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
LoadLibraryExW
TlsFree
EncodePointer
InterlockedFlushSList
RtlUnwind
RaiseException
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
ExitProcess
FindResourceW
LoadResource
LockResource
FreeResource
GetCurrentThreadId
SizeofResource
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LeaveCriticalSection
QueueUserAPC
WriteProcessMemory
VirtualAllocEx
CreateProcessA
WriteConsoleW
OpenMutexW
CreateMutexW
TerminateProcess
GetCurrentProcessId
OpenProcess
IsDebuggerPresent
CreateEventW
CloseHandle
ResumeThread
CreateThread
WaitForSingleObject
SetEvent
FindFirstFileW
FindNextFileW
FindClose
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
TlsAlloc
VirtualFree
FormatMessageA
DecodePointer
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeCriticalSectionEx
UnmapViewOfFile
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
InitializeConditionVariable
TerminateThread
GetExitCodeThread
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
TlsGetValue
TlsSetValue
GetCurrentProcessorNumber
AcquireSRWLockExclusive
GetNativeSystemInfo
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFileEx
lstrlenW
CreateIoCompletionPort
VirtualAlloc
GetModuleFileNameW
SwitchToThread
GetCommandLineW
LocalFree
user32
GetMessageW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
LoadImageW
LoadCursorW
LoadIconW
LoadStringW
WaitForInputIdle
gdi32
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
advapi32
RegisterServiceCtrlHandlerW
SetServiceStatus
SetEntriesInAclW
BuildTrusteeWithSidW
StartServiceCtrlDispatcherW
ControlService
StartServiceW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
ole32
CoCreateInstance
CoCreateGuid
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
comctl32
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ws2_32
bind
closesocket
send
socket
ntohs
connect
recv
htons
setsockopt
getsockname
WSAStartup
inet_ntoa
gethostbyname
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
InetNtopW
freeaddrinfo
getaddrinfo
WSAStringToAddressW
WSAGetLastError
WSAIoctl
WSASetLastError
shutdown
WSACleanup
psapi
EnumProcesses
GetProcessImageFileNameW
shlwapi
StrChrW
fwpuclnt
FwpmGetAppIdFromFileName0
FwpmProviderAdd0
FwpmTransactionCommit0
FwpmSubLayerAdd0
FwpmEngineOpen0
FwpmFilterSetSecurityInfoByKey0
FwpmTransactionBegin0
FwpmFreeMemory0
FwpmFilterAdd0
FwpmEngineClose0
gdiplus
GdipGetImageHeight
GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdiplusStartup
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdipGetImagePixelFormat
GdipFree
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImagePalette
GdipSetCompositingMode
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipCreateBitmapFromStream
winmm
timeGetTime
Sections
.text Size: 630KB - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ