Static task
static1
General
-
Target
cnYwHMCjGJ9Pc9kN.exe
-
Size
6.1MB
-
MD5
a58139eba38cca128d59a9d9e904ebc8
-
SHA1
de42188e0e8c5988af66a0f7b0d136d3a40a538e
-
SHA256
a945842229074ec9e783f78ae3375eaacddae392d3f8adac618593ab6b719026
-
SHA512
b459739c716280664526659db187cc8cd4458485bd7116898d9c2a37dea1bef2f129c1ce89da0cd9c350097601a913591199ba7d0bd9b6289ce93bc32f58d033
-
SSDEEP
49152:TYVwASOjGtlqqzIU6iS2163cuAj/Z7Ctzfx6Lg/OUs2ruT0ic/JsXBXg1Uv2bkO2:Hc+YVqxZztK1bCZ/1n/NFvCGVB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cnYwHMCjGJ9Pc9kN.exe
Files
-
cnYwHMCjGJ9Pc9kN.exe.exe windows:6 windows x64 arch:x64
35b59be9136ca78cc0f3f5527c14fec2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
user32
GetWindowRect
ReleaseDC
SetCursorPos
ReleaseCapture
IsWindowUnicode
SetProcessDPIAware
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
OpenClipboard
SetWindowPos
GetDC
GetMessageExtraInfo
GetKeyState
UpdateWindow
PostQuitMessage
FindWindowW
TranslateMessage
SetLayeredWindowAttributes
PeekMessageW
DispatchMessageW
RegisterClassExW
UnregisterClassW
CreateWindowExW
DestroyWindow
DefWindowProcW
GetWindowThreadProcessId
CloseClipboard
MonitorFromWindow
ShowWindow
EmptyClipboard
GetClipboardData
SetClipboardData
IsIconic
MessageBoxW
GetCursorPos
GetProcessWindowStation
GetUserObjectInformationW
ScreenToClient
gdi32
GetDeviceCaps
CreateSolidBrush
urlmon
URLDownloadToFileA
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
SetWaitableTimer
SetLastError
EnterCriticalSection
CreateWaitableTimerW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
InitializeCriticalSectionEx
WaitForSingleObject
OpenProcess
PostQueuedCompletionStatus
CreateEventW
Sleep
FormatMessageW
GetLastError
GetStdHandle
SetEvent
TerminateThread
CloseHandle
CreateThread
QueueUserAPC
DecodePointer
VirtualAllocEx
LocalFree
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
SleepEx
CreateRemoteThread
GetSystemTimeAsFileTime
FormatMessageA
CreateIoCompletionPort
AllocConsole
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
CompareStringEx
GetStringTypeW
OutputDebugStringW
SetConsoleTextAttribute
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
SleepConditionVariableSRW
WakeAllConditionVariable
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LCMapStringEx
EncodePointer
TryAcquireSRWLockExclusive
GetLocaleInfoEx
RaiseException
RtlPcToFileHeader
SystemTimeToFileTime
GetSystemTime
GetFileSizeEx
VerifyVersionInfoW
PeekNamedPipe
ReadFile
GetEnvironmentVariableA
WaitForSingleObjectEx
GetSystemDirectoryW
GetTickCount
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
FindNextFileW
FindFirstFileW
FindClose
LoadLibraryW
RtlVirtualUnwind
ConvertThreadToFiberEx
ConvertFiberToThread
GetACP
CreateFiberEx
DeleteFiber
SwitchToFiber
RtlUnwindEx
LoadLibraryExW
GetModuleFileNameW
WriteConsoleW
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
ExitProcess
RtlUnwind
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetConsoleOutputCP
HeapAlloc
InitializeSListHead
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
VirtualFree
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
DeviceIoControl
GetWindowsDirectoryW
CreateDirectoryExW
MoveFileExW
AreFileApisANSI
GetModuleHandleExW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
WriteFile
GetSystemDirectoryA
shell32
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantInit
SysFreeString
SysAllocStringByteLen
VariantCopy
SysStringLen
VariantChangeType
VariantClear
SysAllocString
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
ws2_32
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSAGetLastError
setsockopt
ioctlsocket
freeaddrinfo
gethostname
sendto
recvfrom
inet_pton
inet_ntop
htons
htonl
getsockopt
WSAWaitForMultipleEvents
closesocket
WSARecv
WSAAddressToStringW
connect
ntohs
getsockname
getpeername
WSAStartup
getaddrinfo
WSASocketW
WSASetLastError
listen
ntohl
select
WSASend
WSACloseEvent
WSAIoctl
bind
accept
__WSAFDIsSet
WSACleanup
gethostbyname
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getservbyname
recv
send
socket
shutdown
WSAResetEvent
bcrypt
BCryptGenRandom
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindExtension
advapi32
CryptGetUserKey
CryptEncrypt
CryptImportKey
CryptHashData
CryptGetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptAcquireContextA
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersA
CryptGenRandom
CryptReleaseContext
Sections
.text Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ