Static task
static1
Behavioral task
behavioral1
Sample
windows-x86_64-0.9.1.exe
Resource
win10-20231020-en
General
-
Target
windows-x86_64-0.9.1.exe
-
Size
496KB
-
MD5
1d80df4eb41f4abc6e8f22f234d31314
-
SHA1
7356ae887712e2770c0f4997c8a9ca73d61aeddb
-
SHA256
d89f92f60aaaa7f7e37da5d02ae6f934e23c217b2f876ebdcd670f63178a68f6
-
SHA512
66797e1c3600886583ca416c0e47dec43ddc301ec4c58ff4ab542fc67da0da17d47a6249943eddb1f8f145abfc2c3520399183ae4a5d2b1059cd8932caaa0cb6
-
SSDEEP
6144:+R8myH2exQYKl42n3AUGuZ+gCt+yrIi+tfT+NmS3XNRy1MlpafcYIhOfrzX:+RqHXxQYV2PZlXGqtAXjV4b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource windows-x86_64-0.9.1.exe
Files
-
windows-x86_64-0.9.1.exe.exe windows:6 windows x64 arch:x64
202d5814a7e4da66b6c2f0d1e1fc0830
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptGenRandom
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
kernel32
CloseHandle
SetLastError
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
GetProcAddress
GetCurrentThread
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetTempPathW
CreateFileW
GetFullPathNameW
FindFirstFileW
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
AcquireSRWLockExclusive
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetModuleFileNameW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
CreateNamedPipeW
ReadFileEx
SleepEx
WriteFileEx
GetExitCodeProcess
ExitProcess
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
GetConsoleOutputCP
FlushFileBuffers
HeapSize
SetFilePointerEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
user32
MessageBoxW
ntdll
RtlNtStatusToDosError
NtWriteFile
Sections
.text Size: 255KB - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 209KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ