Static task
static1
Behavioral task
behavioral1
Sample
FXSUNATD.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
FXSUNATD.exe
Resource
win10v2004-20231215-en
General
-
Target
FXSUNATD.exe
-
Size
72KB
-
MD5
04bed418b07ccea6654a0054f120d195
-
SHA1
90131ac0a82cc8a0fde6707e107ed7223934b882
-
SHA256
8bfee3078ac7aa428eb3dc24cdf8cda39dd5e640b3118659db8b724ec3e7b243
-
SHA512
3d26f1ea9c33c3bd8572be0d5992e847b2e9d4b3c41f80d352a66efd5677ca6d8093b22f27faf235a03893dbe0eed6bb4c314193c46e247d0bc917321e3c01b7
-
SSDEEP
1536:k1hziE2iwLQMq1f1ksqavhX0hNIj3zdIONNpOS3HDvi:wzL3wsMkqaSIj3zdNkS3HDq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FXSUNATD.exe
Files
-
FXSUNATD.exe.exe windows:10 windows x64 arch:x64
859232723dff84d11c21ef58bca5fe15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
TraceMessage
RegSetValueExW
RegOpenKeyExW
kernel32
CreateSemaphoreExW
OutputDebugStringW
CloseHandle
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
ReleaseMutex
FormatMessageW
ReleaseSRWLockExclusive
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
DebugBreak
IsDebuggerPresent
HeapSetInformation
GetLastError
GetModuleFileNameA
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetLastError
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
WaitForSingleObject
HeapFree
HeapAlloc
GetProcessHeap
msvcrt
_CxxThrowException
memcmp
memset
??1type_info@@UEAA@XZ
wcscmp
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_onexit
_vsnwprintf
free
__CxxFrameHandler4
memcpy_s
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
memmove_s
fxsapi
FaxSetPortExW
FaxSetExtensionDataW
FaxClose
FaxEnumPortsExW
FaxConnectFaxServerW
FaxFreeBuffer
winspool.drv
EnumPrintersW
GetPrinterW
SetPrinterW
ClosePrinter
OpenPrinterW
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ