Static task
static1
Behavioral task
behavioral1
Sample
software.exe
Resource
win10v2004-20240508-en
General
-
Target
software.exe
-
Size
287KB
-
MD5
a81b05effba79397cf4aa4d6c537b75e
-
SHA1
41919dec760e0546fff9236bc17a93af5fec5333
-
SHA256
bbc8c3a139df6941db19011de2121aeec489477838f48d6413a2759c24a3784d
-
SHA512
622e07bd98f5adb845b1e885deb1a161260cf93b95a38a67780471ca0d6c5ef33ad7fd088302f3b9344a6393b604a3cfe0bc83909698a1f33b8053bcff80fe65
-
SSDEEP
6144:yeIqCdKPL+ZpLfkioWIYjlazvbSE9+vN/sW:lIqCIL+ZpLsibIYjmv6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource software.exe
Files
-
software.exe.exe windows:6 windows x64 arch:x64
6e79e08bb35bd48027cb0fff0e4b6474
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
kernel32
WriteConsoleW
HeapSize
GetCurrentDirectoryW
Process32First
WriteProcessMemory
GetStdHandle
SetCurrentConsoleFontEx
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
K32GetModuleFileNameExA
Process32Next
CloseHandle
GetProcAddress
VirtualAllocEx
GetCurrentProcessId
FreeLibrary
GetConsoleWindow
CreateRemoteThread
CreateFileW
GetLastError
GetFileAttributesExW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FormatMessageA
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
LocalFree
GetLocaleInfoEx
QueryPerformanceCounter
RtlUnwind
EncodePointer
DecodePointer
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileSizeEx
SetFilePointerEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
user32
ShowWindow
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
Sections
.text Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ