Static task
static1
General
-
Target
powershell.exe
-
Size
482KB
-
MD5
6726185b70b5adf05e8a1a1df82ebf30
-
SHA1
8db8ff070eabf20486dcd3ba7c84619081880a73
-
SHA256
64dd55e1c2373deed25c2776f553c632e58c45e56a0e4639dfd54ee97eab9c19
-
SHA512
71b4819a56ad465f01a27c5b41039e36364d8bc97c01ee28e9735a00d5a91232ef91fbd554c29d1c883122033fbbce4c62e98e32cd7d6502f339f048ed030432
-
SSDEEP
12288:7egR+xKnNPW2KXzJ4pdd3klnnWosPhnzq:7nUgW2KjJ4Td3kJnbsPhnzq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource powershell.exe
Files
-
powershell.exe.exe windows:10 windows x64 arch:x64
e3007c8e0098d06abf617eee6f0c5abd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
__setusermatherr
_initterm
_fmode
_commode
_lock
_unlock
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__dllonexit
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_onexit
?terminate@@YAXXZ
??0exception@@QEAA@AEBQEBD@Z
??1type_info@@UEAA@XZ
memcmp
_wcsicmp
_wcsnicmp
bsearch
fclose
_wfopen
_itow_s
wcstoul
wcschr
__uncaught_exception
_callnewh
malloc
wcsncmp
memmove_s
wcsrchr
free
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
__C_specific_handler
_XcptFilter
__CxxFrameHandler3
memset
atl
ord30
kernel32
GetVersionExW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
IsDebuggerPresent
IsWow64Process
SetConsoleTitleW
DebugBreak
GetFileType
VerifyVersionInfoW
FindResourceExW
GetModuleHandleW
LoadResource
GetProcessHeap
GetCurrentProcessId
FreeLibrary
UnmapViewOfFile
GetStartupInfoW
GetModuleFileNameA
VerSetConditionMask
FindFirstFileW
CreateFileMappingW
DeleteCriticalSection
CompareStringW
AcquireSRWLockShared
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
LocalFree
GetCurrentProcess
GetStdHandle
ReleaseSemaphore
WriteFile
CreateMutexExW
GetModuleHandleExW
ExpandEnvironmentStringsW
GetProcAddress
WriteConsoleW
MapViewOfFile
LoadLibraryExW
SetThreadUILanguage
K32GetModuleFileNameExW
GetModuleFileNameW
SetErrorMode
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
ReleaseMutex
OpenProcess
CreateToolhelp32Snapshot
ReleaseSRWLockExclusive
FormatMessageW
HeapAlloc
CreateThreadpoolTimer
GetLastError
ReleaseSRWLockShared
Process32NextW
OutputDebugStringW
CloseThreadpoolTimer
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
Process32FirstW
CloseHandle
SetThreadpoolTimer
oleaut32
SysFreeString
SafeArrayPutElement
SafeArrayCreate
SysStringLen
SysAllocString
VariantClear
advapi32
EventSetInformation
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
EventUnregister
EventRegister
RegQueryValueExW
RegCloseKey
EventWriteTransfer
ole32
CoTaskMemAlloc
CoInitialize
PropVariantClear
CoInitializeEx
CoUninitialize
CoCreateInstance
user32
LoadStringW
mscoree
CorBindToRuntimeEx
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 351KB - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ