Static task
static1
Behavioral task
behavioral1
Sample
Napse-GetString.exe
Resource
win10v2004-20240221-en
General
-
Target
Napse-GetString.exe
-
Size
46.4MB
-
MD5
d0feb40c03fcc09ec3da557e8add16ea
-
SHA1
204084308d63ecda092262ea988b354f250b5f49
-
SHA256
84781ca676f4477aeaab3e3722cae2bf2ad0729f1de6414fee80ba55bfe0b478
-
SHA512
6ea809c82adbd7c92384d4f2d3aa56b5fdbb01e45b5e4ef20f9ee6f3cc7e9874a9d1d2d1ac831246511673ab8b828dede15b6a5cb0787f4be1767fd8adbedacd
-
SSDEEP
786432:50puYZapLkcv5xczs0J0XZWvnv2F5yDNfoq8RnMmPbN1EAFF6:qp7ZqZBd02Di9bonM6bN1EAFF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Napse-GetString.exe
Files
-
Napse-GetString.exe.exe windows:6 windows x64 arch:x64
0346904c0d46eab62aebe793097f0742
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
DeleteCriticalSection
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
Sections
.text Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.K~| Size: - Virtual size: 35.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.K7* Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.30} Size: 46.2MB - Virtual size: 46.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ