Static task
static1
General
-
Target
FlameWoo-23.exe
-
Size
32.3MB
-
MD5
800ff843aa75fcfdcd1d92caf54272f0
-
SHA1
b1fee64acd429589466e3f959b4ee47785199d4d
-
SHA256
137c7170c01bdcb9d9fb5b8561d954320c8e3c31e53d2f3c67dcda6f7f06720b
-
SHA512
03e9ae10be61b569baa55fb5adf6a9db6620ff80c21a10eb02fe6675552dd2cfe3184af82f4cbeb7dc6719f2c40b7dbd0d53edb59af63b5673320f2ffc3cf4e0
-
SSDEEP
786432:17VQwhlf5lvo/Ku5Sz10O3Ckz26JUWFPA9Jfn1iG8w:17VQwnRdo/ZmCkz2SBFQn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FlameWoo-23.exe
Files
-
FlameWoo-23.exe.exe windows:4 windows x86 arch:x86
8b108f0ade65ea11b81cc349bb63e1ea
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
RaiseException
ole32
OleUninitialize
user32
PostMessageA
GetForegroundWindow
atl
ord47
shell32
DragQueryFileA
ShellExecuteA
gdi32
GetDeviceCaps
LineTo
advapi32
ControlService
RegQueryValueExA
winspool.drv
ClosePrinter
DocumentPropertiesA
comctl32
ord17
ImageList_Destroy
oledlg
ord8
oleaut32
SafeArrayUnaccessData
UnRegisterTypeLi
shlwapi
PathFileExistsA
winmm
waveOutGetNumDevs
ws2_32
inet_addr
comdlg32
GetSaveFileNameA
wininet
FindFirstUrlCacheEntryA
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 470KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.svmp1 Size: - Virtual size: 7.9MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp3 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp4 Size: 20.7MB - Virtual size: 20.7MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE