Static task
static1
General
-
Target
notmyfault64_korean.exe
-
Size
258KB
-
MD5
43c171dbfc6385648818d9f6b8651516
-
SHA1
c191e332e1ae35f9cf5990fa9b6e1d828163d2e3
-
SHA256
d940475a8735f03e6ba141cd2a30e9b7b9f2d6d8f01d6383a6f8e59792536332
-
SHA512
74689c860a05d0de044df112961e5719ceb0dcde422f4fc6a897ab9cc586168f27477c01bcf5785d502f4c778830d7ab70d90b19db400e77d59a058ea6a4031a
-
SSDEEP
6144:YaSf0x+pFkwkTYZOG20hp4DdQArCjO0fz2:YLfK+842uXi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource notmyfault64_korean.exe
Files
-
notmyfault64_korean.exe.exe windows:5 windows x64 arch:x64
c411249f371c999be170fc603d4d5059
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
StrFormatKBSizeA
comctl32
PropertySheetA
kernel32
OutputDebugStringW
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStringTypeW
CreateFileW
GetProcAddress
DeleteFileA
GetCurrentThreadId
GetCPInfo
LocalFree
GetACP
IsValidCodePage
GetProcessHeap
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetFileAttributesA
FindResourceA
GetEnvironmentVariableA
FormatMessageA
GetTickCount
GetSystemInfo
MulDiv
DeviceIoControl
SizeofResource
LoadResource
LockResource
CreateFileA
CloseHandle
GetLastError
GetVersion
GetModuleHandleA
GetCommandLineW
LoadLibraryA
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetFileType
SetEndOfFile
LCMapStringW
GetOEMCP
LocalAlloc
HeapSize
LoadLibraryExW
GetCurrentProcess
Sleep
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
CreateThread
ExitThread
ResumeThread
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
WriteFile
GetConsoleCP
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
user32
MessageBoxA
InvalidateRect
ReleaseDC
GetDC
DrawTextA
KillTimer
SetTimer
SetFocus
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
ShowWindow
PostQuitMessage
FillRect
RegisterWindowMessageA
wsprintfA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
PostMessageA
gdi32
SetBkMode
SelectObject
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EndPage
StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
SetTextColor
comdlg32
PrintDlgA
ChooseColorA
advapi32
RegQueryValueExA
StartServiceA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExW
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
shell32
CommandLineToArgvW
Sections
.text Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ