Static task
static1
General
-
Target
Air-Explorer-Portable-rar-871450.zip
-
Size
19.6MB
-
MD5
dac929d74d8506a9d07b403dc429ed8e
-
SHA1
0cba424a10d70efbb0e70795dd0267c619085e4e
-
SHA256
1b4e762bfb85d981f6c01946fe9ca07a19be41c640f773ca37a15127210289db
-
SHA512
72406391afa2835d70c30b4df3ef41cba5616d8d5ecc2f7ebdd5448d6b4c6f7cb90a6780aa3d617a1a3e5464f01c1bce05814a9e0f54f4216875828d291a2661
-
SSDEEP
393216:QB64KP4QIBkWbx7EvcXcrO/Hosi1KACbeBmcouPbMOQfkaFoVMLwvn4+Nnf:QB6JIRbx72cGMZFAsIQJkaFoVMyn4+Nf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setupprogram_01234.exe
Files
-
Air-Explorer-Portable-rar-871450.zip.zip
Password: 123
-
Setupprogram_01234.exe.exe windows:6 windows x86 arch:x86
Password: 123
9acb9c28ef53ff89bf9c2e4f4f75a7e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
GetModuleHandleExW
VirtualProtect
MoveFileW
SetUnhandledExceptionFilter
GlobalFree
TryEnterCriticalSection
EncodePointer
GetNumaHighestNodeNumber
GetFullPathNameW
LCMapStringW
CreateTimerQueueTimer
SetFileTime
GetSystemTimeAsFileTime
GetThreadPriority
QueryDepthSList
WaitForMultipleObjects
GetTimeZoneInformation
GetProcAddress
AcquireSRWLockExclusive
GetLogicalDriveStringsW
MultiByteToWideChar
CompareFileTime
GetCommandLineW
FindFirstFileExW
FreeLibraryAndExitThread
ReleaseSemaphore
GetTickCount
HeapFree
GetLocaleInfoW
GetTimeFormatW
SetFilePointerEx
EnumSystemLocalesW
lstrcatA
HeapSize
IsValidLocale
GetFileInformationByHandle
CreateTimerQueue
UnhandledExceptionFilter
WriteConsoleW
TlsFree
ChangeTimerQueueTimer
InitializeSListHead
CreateEventW
LocalFree
Sleep
GlobalMemoryStatus
GetProcessAffinityMask
IsValidCodePage
LeaveCriticalSection
VerSetConditionMask
SetPriorityClass
GetFileAttributesExW
GetConsoleOutputCP
GlobalAlloc
GetStartupInfoW
GetCurrentProcess
GetEnvironmentVariableA
GetUserDefaultLCID
GetSystemDirectoryW
SetEvent
VerifyVersionInfoW
IsProcessorFeaturePresent
VirtualAlloc
SetEnvironmentVariableW
SignalObjectAndWait
GetSystemInfo
GetOEMCP
GetThreadTimes
GetFileSize
FlushFileBuffers
LoadLibraryExW
GetCurrentThread
DuplicateHandle
FormatMessageW
GlobalLock
FindFirstFileW
WaitForSingleObjectEx
WaitForSingleObject
TlsSetValue
InterlockedFlushSList
GetVersion
GetModuleHandleA
SystemTimeToTzSpecificLocalTime
InterlockedPopEntrySList
GetProcessHeap
GetCurrentThreadId
GetACP
GetLastError
VirtualFree
SetLastError
GetDriveTypeW
GetFileType
CreateThread
SetFileAttributesW
GetLogicalProcessorInformation
GetCurrentDirectoryW
GetModuleHandleW
ExitThread
PeekNamedPipe
GetEnvironmentStringsW
WriteFile
SetThreadAffinityMask
EnterCriticalSection
DecodePointer
GetCPInfo
TlsAlloc
CreateFileW
DeleteTimerQueueTimer
ReadConsoleW
WideCharToMultiByte
UnregisterWaitEx
LoadLibraryW
ReadFile
SetStdHandle
CreateSemaphoreW
SetFilePointer
InitializeCriticalSection
GetCurrentProcessId
ResetEvent
RemoveDirectoryW
FindNextFileW
FileTimeToLocalFileTime
FreeLibrary
QueryPerformanceFrequency
GetFileSizeEx
FileTimeToSystemTime
GetStdHandle
GetCommandLineA
SwitchToThread
SleepEx
DeleteCriticalSection
TerminateProcess
InitializeCriticalSectionEx
GetStringTypeW
GlobalUnlock
CreateDirectoryW
IsDebuggerPresent
GetVersionExW
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
RtlUnwind
MoveFileExW
RaiseException
FreeEnvironmentStringsW
CompareStringW
GetDateFormatW
SetEndOfFile
TlsGetValue
FindClose
SetThreadPriority
InterlockedPushEntrySList
ExitProcess
lstrlenA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetTickCount64
UnregisterWait
GetConsoleMode
GetFileAttributesW
QueryPerformanceCounter
CloseHandle
GetModuleFileNameW
HeapAlloc
user32
SetFocus
MessageBoxW
EndDialog
CharUpperW
GetKeyState
SetTimer
SetDlgItemTextW
MapDialogRect
SetClipboardData
PostMessageW
DialogBoxParamW
MonitorFromWindow
SystemParametersInfoW
GetMonitorInfoA
CheckDlgButton
KillTimer
LoadCursorW
GetWindowLongW
GetWindowTextW
SendMessageW
InvalidateRect
SetWindowLongW
IsDlgButtonChecked
SetCursor
GetFocus
GetWindowRect
SetWindowTextW
ShowWindow
OpenClipboard
CloseClipboard
GetDlgItem
LoadIconW
MoveWindow
ScreenToClient
GetWindowTextLengthW
EnableWindow
MessageBoxA
EmptyClipboard
GetParent
LoadStringW
wsprintfA
advapi32
CryptReleaseContext
CryptAcquireContextW
CryptDestroyKey
CloseServiceHandle
CryptHashData
CryptCreateHash
CryptEncrypt
CryptDestroyHash
CryptGetHashParam
CryptImportKey
shell32
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ole32
CoUninitialize
OleInitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
VariantClear
SysAllocStringLen
SysStringLen
bcrypt
BCryptGenRandom
crypt32
CertFreeCertificateChain
CertCloseStore
CertFreeCertificateChainEngine
CryptQueryObject
CertOpenStore
CertFindExtension
CertFreeCertificateContext
CertGetNameStringW
PFXImportCertStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CryptDecodeObjectEx
CertGetCertificateChain
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CryptStringToBinaryW
wldap32
ord73
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ws2_32
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSACreateEvent
WSAIoctl
getsockopt
send
WSAEventSelect
freeaddrinfo
WSAWaitForMultipleEvents
socket
WSAResetEvent
WSAEnumNetworkEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
getaddrinfo
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
WSACloseEvent
Sections
.text Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 275KB - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ