Static task
static1
Behavioral task
behavioral1
Sample
Ares_Exe.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Ares_Exe.exe
Resource
win10v2004-20231215-en
General
-
Target
Ares_Exe.exe
-
Size
606KB
-
MD5
233d3da34ba123df16269531518b3a14
-
SHA1
43aca4aa9856eed971f43690a0680f29a8f250bb
-
SHA256
d4f855cf0359daf7a0deb9d9ed99d883a8244ded0d4b2145d15cae93241fce7f
-
SHA512
b56e5198b2ef0fde517854d79862386d1fddd7c1ba2799c62cb88beb15995ae45f41499b9c455fb5db365438d43dfda1cb55118a9eeafaec7ceb1d54cc9eb621
-
SSDEEP
12288:PHdJmm5G8Bw8q8m5heSH1eTzf7hIhdRUmOt+nx:rFu47hIhdKVYx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Ares_Exe.exe
Files
-
Ares_Exe.exe.exe windows:6 windows x64 arch:x64
569fb8fe74252247a9841e9f33771835
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wininet
InternetCloseHandle
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetErrorDlg
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
WriteConsoleW
HeapSize
GetTimeZoneInformation
HeapReAlloc
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
ReadFile
FindFirstFileW
WriteProcessMemory
VirtualProtect
FindNextFileW
GetCurrentProcess
VirtualAlloc
FindClose
WaitForSingleObject
CreateFileW
SetProcessMitigationPolicy
SwitchToFiber
MultiByteToWideChar
Sleep
GetLastError
FileTimeToSystemTime
DeleteFileW
CloseHandle
CreateThread
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFileSize
ExitProcess
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
ConvertThreadToFiber
CreateFiber
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
WideCharToMultiByte
InitializeCriticalSectionEx
RtlUnwind
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
FindFirstFileExW
user32
GetDesktopWindow
Sections
.text Size: 472KB - Virtual size: 471KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ