Static task
static1
General
-
Target
Arctis_Temporary_Spoofer.exe
-
Size
4.9MB
-
MD5
805b0c1f36cc72caabcd982c0450f46d
-
SHA1
47456ed9c0d9abefe7a3fbc162cbe83939489c48
-
SHA256
559bf8de8dee36c29c3ac5351c339c9d47b508342e198d2bdbbc0c9870e2688e
-
SHA512
3a335b5494dcba5b9254d1ed18035531d3fefb7ecd78ec42ee4499846061367d80fedd8d103a25e21d46d19dda502c6e993c493e2d2c5c2b14d7b619e8b94255
-
SSDEEP
98304:/BbvlmVlhtT30+Q6o/Iwx59fX32ruWC+bK7b7/2OBMHkNMj:pvlmVFTrQjHx59v3uC+S7uN1j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Arctis_Temporary_Spoofer.exe
Files
-
Arctis_Temporary_Spoofer.exe.exe windows:6 windows x64 arch:x64
ee87dc8b314f39177edc39c4b168d3b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3dcompiler_43
D3DCompile
kernel32
CloseHandle
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExW
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
psapi
GetModuleInformation
wininet
InternetReadFile
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertGetCertificateChain
ws2_32
closesocket
rpcrt4
UuidCreate
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
advapi32
CryptDestroyHash
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 801KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SnT Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.K<n Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eDL Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ