Static task
static1
General
-
Target
bad_apple.exe
-
Size
4.8MB
-
MD5
dd1fff60b48a55617165b4cc940aac82
-
SHA1
ce079eb19ec0c93ae0d15b49909b311a4691660e
-
SHA256
fe7adf254318a7ad5966ac66c6e2552bc29cab0d85fcec797a9e0ab2fb9c35d9
-
SHA512
840bf1a56d1221afa8d6ca6a046e8120f1f8586d1bcdd0210dfbf0c78ed509a659469c67847af55bc8855a549035868a5d0e12890bd700f8c21beef73ef119a2
-
SSDEEP
98304:Ry0okJbJDeSdmWaeGzkbqrR7uO3kHQHgHCPfF72yt+7o7W9XfHz8:rok3Dec6QqrZHgHC3LtvS9PH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bad_apple.exe
Files
-
bad_apple.exe.exe windows:6 windows x64 arch:x64
6719662d7d8c0fb86cea28b4efd36ce8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AcquireSRWLockShared
ReleaseSRWLockShared
RtlCaptureContext
GetCurrentDirectoryW
CreateThread
FreeLibrary
GetEnvironmentVariableW
ReleaseMutex
GetCurrentProcess
Sleep
CreateMutexA
GetCurrentProcessId
LoadLibraryA
WaitForSingleObjectEx
FormatMessageW
GetModuleHandleW
QueryPerformanceFrequency
SetLastError
WriteConsoleW
MultiByteToWideChar
GetConsoleMode
GetStdHandle
TryAcquireSRWLockExclusive
GetCurrentThread
GetProcAddress
GetModuleHandleA
WaitForMultipleObjectsEx
WaitForSingleObject
SetEvent
CreateEventA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SwitchToThread
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
CloseHandle
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AttachConsole
RtlLookupFunctionEntry
IsProcessorFeaturePresent
user32
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DispatchMessageA
TranslateMessage
PeekMessageA
SetTimer
SystemParametersInfoA
CreateWindowExA
RegisterClassA
LoadIconW
DefWindowProcA
gdi32
CreateSolidBrush
ole32
CoInitializeEx
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoUninitialize
ntdll
RtlNtStatusToDosError
NtWriteFile
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
vcruntime140
__CxxFrameHandler3
__current_exception
__C_specific_handler
memcpy
memset
memmove
__current_exception_context
memcmp
api-ms-win-crt-math-l1-1-0
round
cos
sin
__setusermatherr
powf
expf
cosf
pow
floorf
floor
atan
exp2
log10
log2
api-ms-win-crt-runtime-l1-1-0
terminate
_crt_atexit
_seh_filter_exe
_initialize_onexit_table
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_cexit
_c_exit
_register_onexit_function
__p___argc
_register_thread_local_exe_atexit_callback
__p___argv
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 444KB - Virtual size: 443KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ