Static task
static1
General
-
Target
mapper.exe
-
Size
53KB
-
MD5
a6fd00fb0e599bca4d14908fef06867c
-
SHA1
983d568245bc7c2b334b0e6336f1f368c8f7df12
-
SHA256
31fedf1d104199c32602c110cb03a06d105051df4fd3d482f82d38a06da467d4
-
SHA512
0c028f8e776b739417a416546f867cac8fe0279c38bce99f8b15d1885323f5df1460e414b3a1d43491fe3c1bb9ad2d75827bf05ac90826ca884d7ed7582ba29a
-
SSDEEP
768:Lg95/g493uIOqylWPNNggF3RH6n5bDQLHrILK74qx61d8hxjti1x2HIef:Lgf/g+0ONggF3RgbDQzrILK7R61d7vC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mapper.exe
Files
-
mapper.exe.exe windows:6 windows x64 arch:x64
95891f0b16bf29038a4b5bcbb2671b91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
LoadLibraryA
UnmapViewOfFile
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
IsBadReadPtr
VirtualProtect
CreateThread
AcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
ReleaseSRWLockExclusive
user32
MessageBoxA
msvcp140
?good@ios_base@std@@QEBA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
ntdll
RtlEnterCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlLeaveCriticalSection
RtlCaptureContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
__C_specific_handler
memcpy
memcmp
memchr
strstr
__std_exception_copy
memset
__std_exception_destroy
__std_terminate
memmove
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
calloc
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initterm
exit
_exit
_configure_narrow_argv
__p___argc
__p___argv
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
_initialize_narrow_environment
terminate
_seh_filter_exe
_initialize_onexit_table
_crt_atexit
_initterm_e
_register_onexit_function
_c_exit
_cexit
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
_set_fmode
__p__commode
__acrt_iob_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ