Static task
static1
General
-
Target
santo.exe
-
Size
38.6MB
-
MD5
e7b9320b12cb6f2c9e1b17cd77f64113
-
SHA1
1599af0655f49fd59cdd2eb46449216f82163198
-
SHA256
cb9a078acb5a1925592864c53cfb1f79c55bb09e55e0279b78cc22589d45c3bb
-
SHA512
032aad0ef3254246da6ba654af01529c8a956db18780a324bc1cfbd122489c8b4f72bcc9b5f66b4613e02cce62e44c5fac46554b1b3927e43d6378485cb3c4fa
-
SSDEEP
786432:msUv2KeqzrBHDvW9RNNJynjXi/P0OKQg4yI+tk229BR+m0y:COKZzr9yNDynj0LKB2t9BR++
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource santo.exe
Files
-
santo.exe.exe windows:6 windows x64 arch:x64
8fc4a7af54eee143d4ae8b63f30cdb48
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
PlaySoundA
kernel32
EnterCriticalSection
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MoveWindow
gdi32
CreateSolidBrush
advapi32
GetUserNameA
shell32
SHGetFolderPathW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
ntdll
RtlAnsiStringToUnicodeString
dbghelp
ImageDirectoryEntryToData
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmReleaseContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
ws2_32
__WSAFDIsSet
normaliz
IdnToAscii
crypt32
CryptQueryObject
wldap32
ord60
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 778KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fxT Size: - Virtual size: 24.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.#8? Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.JH0 Size: 38.6MB - Virtual size: 38.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ