Static task
static1
Behavioral task
behavioral1
Sample
ls.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ls.exe
Resource
win10v2004-20240508-en
General
-
Target
ls.exe
-
Size
94KB
-
MD5
60c5356c96040f5b0607fdb50d3cd7f8
-
SHA1
1ffa59657f23638268444796ad7f9e724b6c2164
-
SHA256
27766263bab296e714e8e73902bfcbbefa3f789e3e93bb35e43986e82e1c18c1
-
SHA512
77ed86d773e48d206e9c4ebcb7c4bf0a35a820ca52db72aea2d27e10d3d877bf26a44334fb80a781d12f04633a57b54485084d70a46b4f0b11931811343fd807
-
SSDEEP
1536:SHT3TgsdsLXE/nf6bhLnCMtXeeX+2O6Nv+OWw8obst+3Onj9:gvgsd/6bVCMtOeXVnAO/BbstMy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ls.exe
Files
-
ls.exe.exe windows:4 windows x86 arch:x86
89a5ca522d9a551a11b8cb128192f938
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msys-1.0
__assert
__errno
__main
_ctype_
_tzname
abort
access
acl
asctime
atexit
calloc
closedir
ctime
cygwin_conv_to_posix_path
cygwin_internal
dirfd
dll_crt0__FP11per_process
exit
fclose
fflush
fprintf
fputs
free
fstat
fwrite
getenv
getgrgid
getgrnam
getpwnam
getpwuid
gettimeofday
gmtime
ioctl
isatty
localeconv
localtime
longjmp
lstat
malloc
mblen
memchr
memcpy
memmove
memset
opendir
putc
qsort
raise
readdir
readlink
realloc
setjmp
setlocale
sigaction
sigaddset
sigemptyset
sigismember
signal
sigprocmask
stat
strcat
strchr
strcmp
strcoll
strcpy
strdup
strerror
strftime
strlen
strncmp
strncpy
strrchr
strtoul
tcgetpgrp
tzset
vsnprintf
msys-intl-8
__printf__
libintl_bindtextdomain
libintl_dcgettext
libintl_fprintf
libintl_gettext
libintl_sprintf
libintl_textdomain
libintl_vfprintf
kernel32
GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile
Sections
.text Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data_cy Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE