Resubmissions
25/05/2024, 15:46
240525-s738qsaa28 10Static task
static1
General
-
Target
240313-epmldaec36_pw_infected.zip
-
Size
220KB
-
MD5
8e1c4d1f7e0cc1e843b630baeb222a0a
-
SHA1
a4794606fbf341295a88dcbc406419addb3b4e82
-
SHA256
e67f8a804bdbeb0cd9be8de25f41c251eda9eaa38f44a937cbf9bb0c304d1530
-
SHA512
9f496d5cad639038ea55a63f99c9d2b35cc7c2f685cbda9913f88d552b2fb2896fcca5da616be2997ee303361657fa6de6964ed78409c23f54912eda1d196a2b
-
SSDEEP
3072:+T3jAqeqz2Xp7jqU0Vt3l0uU6oMSnOUoBedZk61RfEZHw/yRCc+tANA0fN+nTEG:Y3sqebNGU0Vt1MnzVA61Rf4w6w+GINg3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c4ee18d4a484321620bef6ddd00fc620
Files
-
240313-epmldaec36_pw_infected.zip.zip
Password: infected
-
c4ee18d4a484321620bef6ddd00fc620.exe windows:6 windows x86 arch:x86
Password: infected
6ef74f7b87fa15b6df54d064a5b8ef31
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetCommandLineW
WriteFile
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
GetCurrentProcess
ExitProcess
GetExitCodeProcess
CreateProcessW
GetWindowsDirectoryW
VirtualProtect
IsWow64Process
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LocalFree
GetBinaryTypeW
lstrlenW
WideCharToMultiByte
EnumTimeFormatsW
GetConsoleOutputCP
WriteConsoleW
user32
LoadStringW
MessageBoxW
ole32
OleInitialize
OleUninitialize
msvcrt
towlower
malloc
memset
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 286B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ