Static task
static1
Behavioral task
behavioral1
Sample
U盘格式化.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
U盘格式化.exe
Resource
win10v2004-20240508-en
General
-
Target
U盘格式化.exe
-
Size
112KB
-
MD5
987601e08abcf6fe546c078fbac048e0
-
SHA1
ffd65dede74b32178b373a38298fa295a4a42d0c
-
SHA256
478736d35be1837d23361491f9e1748e74df59e200bd459ebab38a3158c77435
-
SHA512
9660c513cbccc37b8b25c07fccfed5a8db12bb07bfe7d982e2e273f00854c04ce54461bb337e4a31b898c51f566cddfd419031df1052e2944629e89ad5805161
-
SSDEEP
1536:YEbX0OxnT+BCSQOPK+OUPi8xl6va7DLQ:RbH+BCS0UPrxlga7o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource U盘格式化.exe
Files
-
U盘格式化.exe.exe windows:4 windows x86 arch:x86
4bc537de466abe12eb6ed7f9bf4ecbd3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointerEx
WriteFile
FindClose
FindFirstFileW
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
GetVolumeInformationW
CreateThread
GetFileAttributesW
GetFullPathNameW
SetVolumeMountPointW
GetVolumeNameForVolumeMountPointW
DefineDosDeviceW
GetLogicalDrives
Sleep
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
SetFileTime
GetFileSize
GetFileTime
SetFileAttributesW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
DeleteFileW
ReadFile
CopyFileW
LoadResource
LockResource
FindResourceW
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
FlushFileBuffers
GetEnvironmentStrings
FreeEnvironmentStringsW
GetTickCount
GetVersionExW
CreateFileW
GetLastError
DeviceIoControl
CloseHandle
GetLogicalDriveStringsW
GetDriveTypeW
FormatMessageW
LocalFree
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetTempPathW
OutputDebugStringW
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
user32
PostMessageW
EndDialog
MoveWindow
GetWindowTextW
SetWindowTextW
EnableWindow
GetWindowRect
SystemParametersInfoW
SetFocus
GetSystemMenu
AppendMenuW
GetDlgItem
SendMessageW
LoadStringW
MessageBoxW
FindWindowW
SetForegroundWindow
DialogBoxParamW
advapi32
EqualSid
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
RegCloseKey
FreeSid
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
ole32
CoInitializeEx
CoUninitialize
comctl32
InitCommonControlsEx
Sections
.text Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SharedD Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ