Static task
static1
Behavioral task
behavioral1
Sample
查询5202.exe
Resource
win10v2004-20231215-en
General
-
Target
查询5202.exe
-
Size
44KB
-
MD5
a95c1694d24ad9b3f9a50de3a709d2d3
-
SHA1
627110987c3b346448e833bec47a74e358cd450a
-
SHA256
1c62e3990102df4bbc7ecc838da7d835a29be08d92b1dfa13bdcd33fe482b53e
-
SHA512
9e5930464d63af253910bb3ec4b2c7fc2e5a94b00538c0b0a863321e1eb6376de03b03f4946e3f97ff51fc6eb4779455d933f76025210c04bccc151d6500e2d2
-
SSDEEP
768:xcpTyO5IlrpivSbzoxZfnzOfX1rBeDnMQkDwXdFxlOEuG5jIho3I:upTVnzElrBeDMmVlOyjIiI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 查询5202.exe
Files
-
查询5202.exe.exe windows:5 windows x64 arch:x64
7a0b21e5000b28609de0d0a32a3ffdfc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
InitOnceExecuteOnce
Sleep
GetStringTypeW
MultiByteToWideChar
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
RtlPcToFileHeader
HeapFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapReAlloc
LCMapStringW
advapi32
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
wininet
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 940B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ