Static task
static1
General
-
Target
547965_5vEkoy.zip
-
Size
22.1MB
-
MD5
34ec11512fab1ca71d5e434beccbcec0
-
SHA1
01708bb8603a38aff3bb66d504fa8f547eb63bcd
-
SHA256
5af00a541b937514973d571d8c448f5c475d95f348b256ae2b18f590ce22d312
-
SHA512
7be15a43aad10edd95f91618786c47c6e403e3b3a6994f89635eeb754e45957feb5b24e0708ae3bf74357fbe091e234d0b01d91fb35d0abe028c606de6dd5b4f
-
SSDEEP
393216:i4haUMZLN4HqiyAiJ7xhaQzVFbRakc2z621qI/Tcryk6GwI6W5:i4hapSB9OxhaU/akr6a/T0TQIF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/547965_5vEkoy.exe
Files
-
547965_5vEkoy.zip.zip
-
547965_5vEkoy.exe.exe windows:6 windows x64 arch:x64
69ca0f6ac33263d018b7e7bf3b2c6649
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
user32
CloseWindow
gdi32
SelectObject
advapi32
RegDeleteValueW
shell32
CommandLineToArgvW
msvcp140
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
gdiplus
GdipMeasureString
shlwapi
ord12
vcruntime140
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
xwJSI0 Size: 15.2MB - Virtual size: 15.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
xwJSI1 Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xwJSI2 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
547965_5vEkoy.ini