Static task
static1
General
-
Target
Install_01210.exe
-
Size
29.0MB
-
MD5
11900045e96a4943479891f245b190e2
-
SHA1
11d6190876642c2400c8b25fbb3b5ffac4bb6062
-
SHA256
7aa49fb12cc15ae555a81464a6e6573ba667010de2de89ed74f978beb05f493d
-
SHA512
9988afabd70337b47ebe45c6e5127d9287cd5dcbc35699c5803102a198e68eff0564220cff11e5ca940fe8bd845059f09a2e799cc300c6ef89db9e2e1e9a9978
-
SSDEEP
786432:VDXmuedKvJTsJmpbJofQZTib6fzfHwSN2MbSZNjt3KWAv6Q:lt76fQZ86fTHwSN2MbSZXKW9Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Install_01210.exe
Files
-
Install_01210.exe.exe windows:6 windows x86 arch:x86
b29b91a7ec90d68903236c0410551a82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadPriority
CreateEventW
GetFileInformationByHandle
GetStringTypeW
TlsSetValue
FormatMessageW
lstrcatA
LocalFree
GetDateFormatW
GetSystemTimeAsFileTime
CreateFileA
GetLogicalDriveStringsW
DeleteFileW
GetFileSizeEx
GetModuleFileNameW
ReleaseSemaphore
FindClose
GetEnvironmentStringsW
DeleteTimerQueueTimer
UnregisterWaitEx
TryEnterCriticalSection
FindNextFileW
GetConsoleCP
WriteConsoleW
EncodePointer
GetFullPathNameW
GetCurrentThread
InterlockedPushEntrySList
GetLogicalDriveStringsA
AreFileApisANSI
InitializeSListHead
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
GetSystemDirectoryW
GlobalAlloc
GetLastError
LoadLibraryExW
MoveFileA
GetModuleHandleExW
GetCurrentProcessId
RemoveDirectoryW
InitializeCriticalSectionEx
TlsFree
GlobalFree
GetFileAttributesA
IsValidCodePage
FormatMessageA
GetVersionExA
SetStdHandle
FindFirstFileA
QueryDepthSList
RemoveDirectoryA
GetCommandLineW
WaitForSingleObjectEx
GetCurrentThreadId
PeekNamedPipe
CreateSemaphoreA
WriteFile
TlsAlloc
SetUnhandledExceptionFilter
ChangeTimerQueueTimer
QueryPerformanceFrequency
lstrlenA
GetEnvironmentVariableA
HeapFree
GetStartupInfoW
GlobalLock
VerSetConditionMask
GetCurrentDirectoryW
LoadLibraryW
InterlockedFlushSList
GetUserDefaultLCID
SetEnvironmentVariableA
SetEndOfFile
GetACP
FreeEnvironmentStringsW
VirtualProtect
ExitProcess
SetPriorityClass
FindNextFileA
CompareFileTime
InitializeCriticalSection
GetTickCount64
FileTimeToSystemTime
SwitchToThread
InterlockedPopEntrySList
SetThreadAffinityMask
SetFileAttributesA
WideCharToMultiByte
GetOEMCP
CreateTimerQueueTimer
FindFirstFileExA
GetCurrentDirectoryA
UnhandledExceptionFilter
GetProcessHeap
GetFileSize
GetConsoleMode
GetNumaHighestNodeNumber
SetFilePointer
HeapAlloc
CreateTimerQueue
SetFileTime
GetVersionExW
WaitForSingleObject
GetSystemInfo
GetDriveTypeW
GetModuleHandleW
IsValidLocale
GetProcAddress
GetProcessAffinityMask
GlobalMemoryStatus
FreeLibrary
CreateEventA
GetVersion
SetFilePointerEx
MultiByteToWideChar
VirtualFree
RtlUnwind
SleepEx
VerifyVersionInfoW
ResetEvent
IsProcessorFeaturePresent
GetThreadTimes
CompareStringW
CreateThread
GetTickCount
CreateDirectoryW
SetLastError
GetLogicalProcessorInformation
TerminateProcess
GetStdHandle
GetLocaleInfoW
GetThreadPriority
CloseHandle
HeapSize
LeaveCriticalSection
RaiseException
CreateFileW
GetModuleFileNameA
QueryPerformanceCounter
FlushFileBuffers
LoadLibraryA
ExitThread
ReadConsoleW
MoveFileW
EnterCriticalSection
MoveFileExW
TlsGetValue
DuplicateHandle
ReleaseSRWLockExclusive
CreateDirectoryA
HeapReAlloc
DecodePointer
ReadFile
WaitForMultipleObjects
RegisterWaitForSingleObject
SetEvent
GlobalUnlock
GetFileAttributesExW
GetFileAttributesW
Sleep
EnumSystemLocalesW
GetModuleHandleA
AcquireSRWLockExclusive
FileTimeToLocalFileTime
SignalObjectAndWait
UnregisterWait
IsDebuggerPresent
DeleteFileA
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
SetFileAttributesW
VirtualAlloc
GetCommandLineA
LCMapStringW
GetTimeZoneInformation
GetFileType
FindFirstFileW
FreeLibraryAndExitThread
DeleteCriticalSection
GetCPInfo
user32
MapDialogRect
CheckDlgButton
EnableWindow
SetFocus
EndDialog
GetWindowLongA
GetParent
IsDlgButtonChecked
SetClipboardData
GetMonitorInfoA
EmptyClipboard
CloseClipboard
GetKeyState
CharUpperA
wsprintfA
ShowWindow
SendMessageW
SetWindowTextW
MessageBoxW
GetWindowRect
DialogBoxParamA
LoadIconA
SetTimer
GetWindowTextLengthW
GetFocus
SetCursor
SetWindowLongA
SetWindowTextA
MonitorFromWindow
InvalidateRect
GetWindowTextA
OpenClipboard
SystemParametersInfoA
GetWindowTextW
GetWindowTextLengthA
CharUpperW
PostMessageA
LoadCursorA
LoadStringA
MoveWindow
MessageBoxA
SendMessageA
ScreenToClient
LoadStringW
DialogBoxParamW
GetDlgItem
KillTimer
advapi32
CryptDestroyHash
CryptAcquireContextW
CryptGetHashParam
CryptReleaseContext
CryptHashData
CryptEncrypt
CryptImportKey
CloseServiceHandle
CryptCreateHash
CryptDestroyKey
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHGetFileInfoA
ole32
CoUninitialize
OleInitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
bcrypt
BCryptGenRandom
crypt32
CertGetCertificateChain
CertFindCertificateInStore
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertFreeCertificateChain
CertFindExtension
CertOpenStore
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CertAddCertificateContextToStore
CertGetNameStringW
CertEnumCertificatesInStore
wldap32
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ws2_32
WSAIoctl
WSACreateEvent
recvfrom
sendto
getpeername
ioctlsocket
gethostname
socket
getsockopt
send
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
getaddrinfo
WSACloseEvent
WSAResetEvent
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
freeaddrinfo
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
Sections
.text Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 239KB - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ