Static task
static1
General
-
Target
稽查事项通知册-终端.exe
-
Size
25.4MB
-
MD5
6bd7b1da6cecdda481d35391eb2ba24f
-
SHA1
fd46f546cbc703e2eb18c034a65b8d6d4513dfde
-
SHA256
597c2571ca9db64c4086a2e7d05fe3cb833a622b297b252c295c37e7a69a1168
-
SHA512
fed66213ca5804e9178b454b0912cc97e93c4a0068d904f05d9e31d06f13f5f1ca92f09709bf705a8207d0d32ee91f766279cb7c296e6f2585b328a34ed58a0f
-
SSDEEP
196608:k9eOMXatrUWtKha8RM1Lxd4rSnL03ckSMBVpw2WLLjs4gLBLILvrdT9wvurNGwnk:ihMwUDh/urno3ck5XePjGkvrbuwGwn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 稽查事项通知册-终端.exe
Files
-
稽查事项通知册-终端.exe.exe windows:6 windows x64 arch:x64
f18991250c01bbd0ac9f30ec24bf1e66
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
GetFileSize
ExitProcess
CreateFileA
VirtualFree
CloseHandle
GetModuleFileNameW
ReadFile
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
shell32
ShellExecuteExW
Sections
.text Size: 15.6MB - Virtual size: 15.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.code Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 801KB - Virtual size: 801KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 800KB - Virtual size: 800KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ