Static task
static1
Behavioral task
behavioral1
Sample
guanwang_13.10.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
guanwang_13.10.exe
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
guanwang_13.10.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral4
Sample
guanwang_13.10.exe
Resource
win11-20231128-en
General
-
Target
guanwang_13.10.exe
-
Size
55KB
-
MD5
2a21d8321b1fd106c87d8d174d1de168
-
SHA1
27aa9ea68bf895a07303f61c8d68c67c801e5000
-
SHA256
1ba3a1680c735bc05ffa7f540e247dc81ef9863f05e83ece457a767e483741da
-
SHA512
3ae52d4286955c4a9f6397d1761a48ec26fc7bf353698a8e0a9c6a62fb9fe5c1a26257b3ff0d2a8c86c3018e93236477ce8a490c7be860285ffe06d890c165ab
-
SSDEEP
1536:Syr/dlJjmTUiAGf+nMZY+mGK+3hxgUVXWo:rvJjmTUiApnWY7I33gUVGo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource guanwang_13.10.exe
Files
-
guanwang_13.10.exe.exe windows:5 windows x64 arch:x64
21cdc21c2d7903d5bace2b83eb7f6558
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
LoadLibraryA
VirtualProtect
EncodePointer
DecodePointer
GetModuleHandleW
ExitProcess
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapAlloc
GetLastError
HeapFree
RaiseException
RtlPcToFileHeader
Sleep
HeapSize
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ