demo_protected[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

demo_protected.exe
Size

1.1MB
MD5

b742b1f4344fdfd95330cbf53b22094a
SHA1

3f15014d4d0d1358d7c4009d58daf7808a4784ba
SHA256

08fdca3d4b4b5750d503321799137ffb96788d0507796de070f9fe0031394c9d
SHA512

e027a0e48429b190d65d70bf057b9d30fb7dc474f39a20c0b1f6eab2ae166d7410850bbb428a2703673528f29b967d22c9f4657a0214335faaa0b7f561384136
SSDEEP

12288:1gd7dODpOWVrcxrIZPkBny7Aar1IJwkK9jLPiVZ6+QCGcTRncw:1sO92ZePEYeO952Vo+QCBTRcw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
demo_protected.exe

Files

demo_protected.exe
.exe windows:6 windows x64 arch:x64

f1991fd3267bf2c42a2612b30c24611c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

Sleep
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter

user32

GetAsyncKeyState

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?is@?$ctype@D@std@@QEBA_NFD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??Bid@locale@std@@QEAA_KXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException
__current_exception_context
__std_exception_copy
memcpy
__std_exception_destroy
__current_exception
memset
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

__p___argc
_initialize_onexit_table
_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
terminate
exit
_c_exit
_invalid_parameter_noinfo_noreturn
_initterm_e
__p___argv
_cexit
_set_app_type
_seh_filter_exe
_initterm
_get_initial_narrow_environment
system
_initialize_narrow_environment
_register_onexit_function
_configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__p__commode
_set_fmode
__acrt_iob_func

api-ms-win-crt-convert-l1-1-0

atoll

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.Tf63
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hjkUa
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.6heT
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Z0fba
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.i1aY
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.7Sh8c
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.Sd0c
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dgS2
Size: 832KB - Virtual size: 832KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f1991fd3267bf2c42a2612b30c24611c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.Tf63 Size: 267KB - Virtual size: 267KB

.hjkUa Size: 7KB - Virtual size: 7KB

.6heT Size: 512B - Virtual size: 512B

.Z0fba Size: 1KB - Virtual size: 1KB

.i1aY Size: 512B - Virtual size: 480B

.7Sh8c Size: 512B - Virtual size: 96B

.Sd0c Size: 65KB - Virtual size: 64KB

.dgS2 Size: 832KB - Virtual size: 832KB

.Tf63
Size: 267KB - Virtual size: 267KB

.hjkUa
Size: 7KB - Virtual size: 7KB

.6heT
Size: 512B - Virtual size: 512B

.Z0fba
Size: 1KB - Virtual size: 1KB

.i1aY
Size: 512B - Virtual size: 480B

.7Sh8c
Size: 512B - Virtual size: 96B

.Sd0c
Size: 65KB - Virtual size: 64KB

.dgS2
Size: 832KB - Virtual size: 832KB