Static task
static1
Behavioral task
behavioral1
Sample
ansicon.exe
Resource
win10v2004-20231215-en
General
-
Target
ansicon.exe
-
Size
16KB
-
MD5
766f6cf1d68c02ea972c512657485042
-
SHA1
a729494989f9cc40a56e89a4160395085c409d13
-
SHA256
09036cf157a4469ee02d5fab629ece6723d589101ec077b337e3b372804e0b10
-
SHA512
1699aef1138215c08a7094acf14f91142e06e1b03f4198719f52bfaec512b99129a83b7e88b6c1576758db8f4ff7c4ac8a134d3ae89e74b43ae5ad7382c89f7b
-
SSDEEP
384:gfN/6NwGqmMdJfMbwLrSocQUtWMMKtete25jBtI:gVTmm7AEI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ansicon.exe
Files
-
ansicon.exe.exe windows:5 windows x64 arch:x64
Password: infected
27b6b8cfb0c591ab6f76521230104854
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ansi64
log_level
InjectDLL
prog_path
ProcessType
DEBUGSTR
DllNameType
GetProcRVA
DllName
RemoteLoad64
IsConsoleHandle
msvcrt
fwprintf
sprintf
setlocale
_isatty
_setmode
_wtoi
wprintf
fflush
wcspbrk
memchr
qsort
memcpy
_snwprintf
towlower
iswctype
malloc
wcsstr
wcschr
memmove
_wcsicmp
__iob_func
_fileno
_get_osfhandle
fputws
free
kernel32
GetLastError
GetConsoleOutputCP
GetCommandLineW
GetEnvironmentVariableW
OpenProcess
SetEnvironmentVariableW
RtlZeroMemory
CreateProcessW
SetConsoleCtrlHandler
GetExitCodeProcess
GetStdHandle
WriteFile
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
ReadFile
lstrcmpiW
GetCurrentProcessId
WriteConsoleW
VirtualFreeEx
WaitForSingleObject
Process32FirstW
WriteProcessMemory
VirtualAllocEx
CloseHandle
Module32NextW
Module32FirstW
IsWow64Process
Sleep
CreateRemoteThread
CreateToolhelp32Snapshot
GetTickCount
LocalFree
FormatMessageW
Process32NextW
advapi32
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ