Static task
static1
General
-
Target
BEST-DA-HOOD-KILLBOT-SCRIPT-NEVERLOSE-FIGHTS-B-311368.zip
-
Size
19.6MB
-
MD5
149460086f7cb4904808b9941d34263d
-
SHA1
6a95f4f21acce86c1f545b14bd21a90282aec8b8
-
SHA256
774a8c5a9a4355405dfb49b0577da7546e2c5fb24d48871c78ef236cdc21b0db
-
SHA512
3f35d609d0da62f8845a8ea752e4b8939e0f6c465c0005627bf7ce3cf3b757790978d6972d3a026689315a1bae657d1b84dcc69ef9e86b35276cf58cb7c7352d
-
SSDEEP
393216:3TnSVqeIQR20p3xcBwhw/y1rseSja6SBuNycQsvTeMu10srafsjKrpOwBXy:3LfQ9p3xaw+i//6U4Cp0srafsWpOwBC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/App_02029.exe
Files
-
BEST-DA-HOOD-KILLBOT-SCRIPT-NEVERLOSE-FIGHTS-B-311368.zip.zip
-
App_02029.exe.exe windows:6 windows x86 arch:x86
56e27e593045b4f6f67b30951b73ea07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
RemoveDirectoryW
SetEvent
FormatMessageW
GetSystemInfo
Sleep
UnhandledExceptionFilter
GetEnvironmentVariableA
WaitForSingleObject
FreeLibrary
GetFileAttributesW
IsValidLocale
GetFileInformationByHandle
CreateSemaphoreW
ExitProcess
DeleteFileW
GetVersionExW
GetProcessHeap
ReleaseSRWLockExclusive
GetModuleHandleA
InterlockedPushEntrySList
GetFileAttributesExW
MoveFileExW
GetSystemDirectoryW
LCMapStringW
FileTimeToSystemTime
GlobalFree
DeleteTimerQueueTimer
VirtualFree
GetCommandLineW
LoadLibraryExW
GetCommandLineA
GetCurrentThread
VerifyVersionInfoW
GetThreadPriority
SetFileAttributesW
AcquireSRWLockExclusive
RtlUnwind
InitializeSListHead
RegisterWaitForSingleObject
SetEndOfFile
SleepEx
GetProcessAffinityMask
InitializeCriticalSectionEx
VerSetConditionMask
MoveFileW
GetDriveTypeW
SetThreadAffinityMask
HeapAlloc
ResetEvent
DecodePointer
GetProcAddress
CreateDirectoryW
GetFullPathNameW
lstrcatA
GetStdHandle
GetUserDefaultLCID
UnregisterWait
ReleaseSemaphore
InterlockedPopEntrySList
CreateTimerQueueTimer
GlobalMemoryStatus
SwitchToThread
GetCurrentThreadId
QueryPerformanceCounter
HeapReAlloc
EnterCriticalSection
ReadFile
LocalFree
GetLogicalDriveStringsW
GetTimeFormatW
GetLogicalProcessorInformation
FlushFileBuffers
MultiByteToWideChar
TlsSetValue
EncodePointer
GetACP
GetModuleHandleExW
CreateEventW
SetEnvironmentVariableW
SetPriorityClass
TerminateProcess
CreateTimerQueue
WriteFile
TryEnterCriticalSection
GetConsoleMode
GetTickCount
GetNumaHighestNodeNumber
FindClose
ChangeTimerQueueTimer
GetVersion
lstrlenA
ExitThread
VirtualProtect
FindFirstFileExW
GetStartupInfoW
GetFileSizeEx
GetTimeZoneInformation
IsProcessorFeaturePresent
IsValidCodePage
FreeLibraryAndExitThread
GetLocaleInfoW
HeapSize
SetUnhandledExceptionFilter
GetCPInfo
GetCurrentProcess
IsDebuggerPresent
TlsFree
PeekNamedPipe
QueryDepthSList
FindFirstFileW
GetModuleFileNameW
DuplicateHandle
GetDateFormatW
WriteConsoleW
WaitForSingleObjectEx
WideCharToMultiByte
InitializeCriticalSection
TlsAlloc
GetCurrentDirectoryW
GlobalAlloc
SetLastError
SystemTimeToTzSpecificLocalTime
GetConsoleOutputCP
CompareFileTime
GetCurrentProcessId
QueryPerformanceFrequency
FileTimeToLocalFileTime
EnumSystemLocalesW
VirtualAlloc
CreateThread
GlobalUnlock
TlsGetValue
SetThreadPriority
CloseHandle
GetStringTypeW
CompareStringW
FreeEnvironmentStringsW
SetFileTime
GetOEMCP
GetEnvironmentStringsW
LoadLibraryW
RaiseException
GetTickCount64
GetThreadTimes
InitializeCriticalSectionAndSpinCount
UnregisterWaitEx
SignalObjectAndWait
SetFilePointer
GetSystemTimeAsFileTime
GlobalLock
SetStdHandle
DeleteCriticalSection
HeapFree
WaitForMultipleObjects
ReadConsoleW
FindNextFileW
GetFileType
SetFilePointerEx
GetLastError
CreateFileW
LeaveCriticalSection
GetFileSize
InterlockedFlushSList
user32
MessageBoxA
SetDlgItemTextW
wsprintfA
InvalidateRect
SetWindowTextW
GetWindowTextLengthW
ScreenToClient
GetWindowLongW
LoadIconW
MoveWindow
OpenClipboard
GetFocus
SetTimer
LoadStringW
KillTimer
SetFocus
MessageBoxW
EnableWindow
IsDlgButtonChecked
GetParent
MapDialogRect
GetMonitorInfoA
LoadCursorW
SendMessageW
SystemParametersInfoW
GetKeyState
CloseClipboard
GetDlgItem
SetCursor
GetWindowTextW
EndDialog
MonitorFromWindow
GetWindowRect
SetWindowLongW
CharUpperW
DialogBoxParamW
SetClipboardData
EmptyClipboard
CheckDlgButton
PostMessageW
ShowWindow
advapi32
CryptEncrypt
CryptReleaseContext
CryptAcquireContextW
CryptHashData
CloseServiceHandle
CryptDestroyKey
CryptDestroyHash
CryptGetHashParam
CryptImportKey
CryptCreateHash
shell32
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetPathFromIDListW
ole32
CoInitialize
CoCreateInstance
CoTaskMemFree
OleInitialize
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen
bcrypt
BCryptGenRandom
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore
CertFreeCertificateChainEngine
CertCloseStore
CertFindExtension
CertCreateCertificateChainEngine
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CertFindCertificateInStore
CertGetNameStringW
CertEnumCertificatesInStore
CryptStringToBinaryW
PFXImportCertStore
CertFreeCertificateContext
wldap32
ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ws2_32
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAEventSelect
WSACreateEvent
getsockopt
send
getaddrinfo
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
socket
WSAIoctl
freeaddrinfo
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSAResetEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSACloseEvent
Sections
.text Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 277KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ