Static task
static1
Behavioral task
behavioral1
Sample
good.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
good.exe
Resource
win10v2004-20231127-en
General
-
Target
good.exe
-
Size
919KB
-
MD5
10213a9c135cbcc986e45836c93a6532
-
SHA1
367b00d5c88ec382850fd82d975cecb18d0c436d
-
SHA256
0f4d2936d0e9b4fa5a2474d6bf48e0cf70cb58ec6c2349a2f25ab3c859857055
-
SHA512
0dd93f2e9369c7e16a535e9ff3394b9f02435f4a35c58d25e95b79ab6568e190806b0efdc1c88a317d2c366bf7b7287a877c0eab1d1d2b8ebfc1916f13abecdb
-
SSDEEP
24576:RmeCwcJXthwk7DK3N+YQRkN5oPSEKOczMrw:LDk7DsnX5J14rw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource good.exe
Files
-
good.exe.exe windows:5 windows x86 arch:x86
9b63d28cb8480e538f06ade0a99627d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumDateFormatsExW
LoadResource
SystemTimeToTzSpecificLocalTime
GlobalAddAtomA
InterlockedIncrement
GetCurrentProcess
GetSystemWindowsDirectoryW
InterlockedCompareExchange
GetComputerNameW
OpenSemaphoreA
GetTickCount
GetDateFormatA
TlsSetValue
GetVolumePathNameW
GetCurrencyFormatW
GlobalAlloc
GlobalFindAtomA
Sleep
AssignProcessToJobObject
SizeofResource
GetSystemWindowsDirectoryA
CreateFileW
FlushFileBuffers
GetConsoleAliasesLengthW
InterlockedExchange
GetLastError
SetLastError
BackupRead
GetProcAddress
GetProcessHeaps
VirtualAlloc
BeginUpdateResourceW
BackupWrite
SetComputerNameA
LoadLibraryA
CreateFileMappingW
FoldStringW
FindFirstVolumeMountPointA
CreateIoCompletionPort
GetModuleHandleA
VirtualProtect
GetVersionExA
FindAtomW
LCMapStringW
GetFullPathNameA
FindFirstChangeNotificationW
CreateJobObjectA
GetComputerNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
GetStartupInfoW
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsFree
GetCurrentThreadId
HeapSize
HeapFree
TerminateProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapAlloc
HeapReAlloc
RtlUnwind
user32
RealGetWindowClassA
gdi32
SetDeviceGammaRamp
advapi32
RegisterEventSourceW
Sections
.text Size: 852KB - Virtual size: 852KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ