_MainWndProc@16
_StubFileWrite@12
Static task
static1
1 signatures
General
-
Target
halflifedemo.exe
-
Size
48.5MB
-
MD5
df9a3e97bd5aac1fa323270d511a3ec2
-
SHA1
b64efd7fcc953a5f0081bbb384c1744bc75f501d
-
SHA256
cfc5de7ed246c3ddd200ab5cd0382b6c31403fa85ac0ead1f4f19ceffc520e77
-
SHA512
ad31a177e7ea343dcf231312d57b477ff184f65a391e465342b2d9f05e9107489ffe179c9e6346301eb7c57932d75ec68c270edfa00b92cecfd11ae22e3453a8
-
SSDEEP
1572864:h0ghSgLmKON5CaVoLvJ8YF3mW0JsFLAcY:h3HLmr6bJNF3mNEk
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource halflifedemo.exe
Files
-
halflifedemo.exe.exe windows:4 windows x86 arch:x86
Password: infected
3dbb35930afd16d5a0423571da5ea031
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
lstrlenA
_lopen
GetCommandLineA
GetModuleHandleA
GetModuleFileNameA
_lwrite
_llseek
GlobalUnlock
lstrcpyA
MulDiv
_lclose
GlobalAlloc
GlobalFree
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFile
GetVersionExA
GetCurrentProcess
WinExec
ExitProcess
_lread
GetTempPathA
GetTempFileNameA
GlobalLock
user32
GetDC
PostQuitMessage
InvalidateRect
BeginPaint
EndPaint
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
ReleaseDC
SetWindowPos
ShowWindow
LoadIconA
LoadCursorA
RegisterClassA
MessageBoxA
ExitWindowsEx
SetTimer
UpdateWindow
gdi32
DeleteObject
GetStockObject
GetDeviceCaps
PatBlt
CreateSolidBrush
GetTextExtentPointA
TextOutA
SetTextColor
SetBkMode
SelectObject
StretchDIBits
SelectPalette
CreatePalette
CreateFontA
RealizePalette
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ