Static task
static1
Behavioral task
behavioral1
Sample
demon.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
demon.exe
Resource
win10v2004-20240226-en
General
-
Target
demon.exe
-
Size
111KB
-
MD5
e82c22e0e4f31f9c32434402e2d05a08
-
SHA1
ba39127c4da302ee58cfdbcb00e906d8d08b8386
-
SHA256
deb3edc537df860cca87d1111b48b44abd6833cb277129833b4c2fe10ca32f6b
-
SHA512
d64721af1ccf03e491e2a6608ddbe6f245e65b7207993668f1f41b89e7d4535ff4e7a98df9192ce142e0126b3d921267f05d391b08f9faf3bc03a595e2b80e94
-
SSDEEP
1536:cfJ3pj6aQvTyKAQQCETDxzeh1ylWrRp3JbI9sLczZuW0dq:0x3Y+KAQQCgg1ylWLHczZv0dq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource demon.exe
Files
-
demon.exe.exe windows:4 windows x64 arch:x64
1299062c7b29ddbc3d30daa2b2edea43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetStartupInfoA
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__initenv
__iob_func
__getmainargs
__set_app_type
_acmdln
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
memcpy
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
signal
strlen
strncmp
vfprintf
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 400B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 54B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ