Static task
static1
Behavioral task
behavioral1
Sample
查询目录通用版6021.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
查询目录通用版6021.exe
Resource
win10v2004-20240226-en
General
-
Target
d8859fdf0a154cb634bd7ad1e95220e438296717ea6280f10dbf41f3c8cd0760.zip
-
Size
25KB
-
MD5
4c72e702b32ec58fe6e0713939c310fb
-
SHA1
a831a70268d443ef3a05762d6b754f3cd7474caf
-
SHA256
df8ddec239d5a42c8aaa7ac21a1ac30b0fcb95a7d0e56b490004f381aec97169
-
SHA512
dcd737ae15a477602c61752dae0c18cabc4beda27e11dc18b84ad1f2fbdcb93d6820f4e036abd42cccbb847f987a92072ce91a3fae598dcc4e910778bea36e12
-
SSDEEP
768:Qgjj8/+639i8FQGPloMmhbgoJlGE40yLYQgOep:QgjgsvemtJryX5i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/查询目录通用版6021.exe
Files
-
d8859fdf0a154cb634bd7ad1e95220e438296717ea6280f10dbf41f3c8cd0760.zip.zip
Password: threatbook
-
d8859fdf0a154cb634bd7ad1e95220e438296717ea6280f10dbf41f3c8cd0760.zip
Password: threatbook
-
查询目录通用版6021.exe.exe windows:5 windows x64 arch:x64
Password: threatbook
79b675557f6237fa4640cc756dd83f05
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
CreateFileW
SetStdHandle
WriteConsoleW
CloseHandle
SetFilePointer
GetStringTypeW
LCMapStringW
FlushFileBuffers
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineW
GetStartupInfoW
HeapSetInformation
GetVersion
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
HeapSize
GetConsoleCP
GetConsoleMode
user32
CharLowerA
winhttp
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 702B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ