Static task
static1
Behavioral task
behavioral1
Sample
msinfo.exe
Resource
win10-20240221-en
General
-
Target
msinfo.exe
-
Size
6.6MB
-
MD5
a35ec6f31b2a552aeb9689eae94e6fcf
-
SHA1
c14de97478918e14673bdf932d2452d431bf8316
-
SHA256
08bf0ae96d4f009add4923b5a20f486e6b2e6ecf3431d8630648d3d90966f606
-
SHA512
957fd4f7b46f2f4c9a0a6ece8e522b7efb38ad1d53888a5b509f5415673299a02abeba2f232a7b5e543a6b683be37c05090536f588df3167c9c3077a906827f3
-
SSDEEP
196608:DH2B3MlnLgdCD3GGzgARtv3bJss0OH14J8s:DH64n0C3GGzgAzrHV4J8s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource msinfo.exe
Files
-
msinfo.exe.exe windows:5 windows x86 arch:x86
22d11d743995e3d89fa68199f27332d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
urlmon
URLDownloadToFileA
wpcap
pcap_sendqueue_destroy
wininet
HttpOpenRequestA
winhttp
WinHttpReceiveResponse
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegisterEventSourceA
ole32
CoInitialize
shell32
ShellExecuteA
oleaut32
VariantClear
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoA
dbghelp
MiniDumpWriteDump
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qq0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qq1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ