Static task
static1
Behavioral task
behavioral1
Sample
DotNet35.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
DotNet35.exe
Resource
win10v2004-20240426-en
General
-
Target
DotNet35.exe
-
Size
248KB
-
MD5
f590d65dce86589b0e0d507cfeef9f68
-
SHA1
c3012a66acaea8801446ee61f8213a663eb7a76a
-
SHA256
e93c1a0696b59a58e2444eb69ddf165eed71ad159624674a7fe6c91e9852443a
-
SHA512
0b8db83d9267e8691b2a667055184890d6d3270da41ec92c623a594506d64dcc99b2b188ade17734e82ece970e1c4d9045d7ec62a789c3c726490dbf6b3489c2
-
SSDEEP
3072:9JgHn4HL1YrAk6VF5EKIXRsPQq3w04FE4tOjtxFmFlep2/5t122LXQs3G:PgHnwL6rAHVF5Hm2fTCcr4AU3EB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DotNet35.exe
Files
-
DotNet35.exe.exe windows:6 windows x64 arch:x64
ab1cd5b17a80eb84112ed3c5e756bf14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
TerminateThread
AddVectoredExceptionHandler
GetModuleFileNameW
GetLastError
CloseHandle
LoadLibraryW
GetProcAddress
CreateNamedPipeA
GetDriveTypeA
GetNativeSystemInfo
GetCurrentProcessId
GetCurrentThreadId
OpenThread
GetCurrentDirectoryW
SetCurrentDirectoryW
ReadFile
SetHandleInformation
TerminateProcess
CreatePipe
PeekNamedPipe
CreateProcessW
GetExitCodeProcess
WriteProcessMemory
GetCurrentProcess
WriteFile
InitializeProcThreadAttributeList
ResumeThread
ExitThread
OpenProcess
GetExitCodeThread
UpdateProcThreadAttribute
GetThreadContext
VirtualAllocEx
CreateRemoteThread
SetThreadContext
ConnectNamedPipe
CreateFileW
GetFileAttributesW
WaitForSingleObject
CreateEventW
GetCurrentThread
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
FlushFileBuffers
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GlobalUnlock
GlobalLock
GetLocalTime
GetDriveTypeW
Sleep
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetConsoleCP
LCMapStringW
GetFileType
HeapAlloc
ReadConsoleW
GetConsoleMode
HeapFree
FindClose
FindNextFileW
FindFirstFileW
GetStdHandle
ExitProcess
SetEvent
CreateThread
GetModuleHandleExW
FreeLibraryAndExitThread
LoadLibraryExW
FreeLibrary
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
ToUnicode
GetWindowTextW
SetWindowsHookExW
GetClipboardData
GetForegroundWindow
CloseClipboard
OpenClipboard
GetKeyboardState
CallNextHookEx
GetKeyState
GetMessageW
CreateWindowExW
DestroyWindow
GetKeyboardLayout
UnregisterClassW
RegisterClassExW
advapi32
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameW
GetTokenInformation
ole32
CoCreateGuid
wininet
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle
InternetOpenW
HttpAddRequestHeadersA
InternetConnectW
InternetSetOptionW
InternetReadFile
bcrypt
BCryptGetProperty
BCryptGenRandom
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptDecrypt
crypt32
CryptImportPublicKeyInfoEx2
CryptDecodeObjectEx
shlwapi
PathFindFileNameW
iphlpapi
GetAdaptersInfo
ws2_32
WSAStartup
gethostbyname
gethostname
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ