Static task
static1
Behavioral task
behavioral1
Sample
playit.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
playit.exe
Resource
win10v2004-20240508-en
General
-
Target
playit.exe
-
Size
4.4MB
-
MD5
b52b1b1b92b4c4e96a9352becdc372b5
-
SHA1
0ae0aa823e4daa2f644c574f64281fd4f3a36d31
-
SHA256
7dcc38a9820ccb0de9c5652fda9976d9f649f4239ac5e746a419f3076b324dd7
-
SHA512
9e0ef219b2a8afffbaf21100c00a491a218e5a38690b7c033ce6c049544a85f12414b0f3be4099ed55cc69b05c4f0f6fac28392e91a70e4b4ccd255a4101b4fe
-
SSDEEP
49152:2CofikO+oAJR8rvpdThn4q+8+2gU4I+dkk5D28AWbriIM/yKlauC8pPA472y76W8:SfhSf4qfMHWBZC5q++gbhPEcSsX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource playit.exe
Files
-
playit.exe.exe windows:6 windows x64 arch:x64
f4248b0b3135a4e866553181a67b6e0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
SystemFunction036
kernel32
ReleaseSRWLockShared
SwitchToThread
AcquireSRWLockExclusive
DeleteFileW
GetLastError
CloseHandle
ReleaseSRWLockExclusive
lstrlenW
GetSystemInfo
GetCommandLineW
SetLastError
GetModuleFileNameW
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetConsoleMode
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleCursorPosition
WaitForMultipleObjects
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
CreateFileW
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
CreateDirectoryW
FindFirstFileW
FindClose
CreateThread
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
GetFileType
SetHandleInformation
PostQueuedCompletionStatus
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
user32
GetKeyboardLayout
GetWindowThreadProcessId
ToUnicodeEx
GetForegroundWindow
ntdll
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtReadFile
NtWriteFile
ws2_32
WSACleanup
recv
sendto
getsockopt
getpeername
setsockopt
closesocket
WSAIoctl
WSAGetLastError
getsockname
socket
ioctlsocket
WSASocketW
bind
getaddrinfo
freeaddrinfo
send
shutdown
connect
WSAStartup
recvfrom
WSASend
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
bcrypt
BCryptGenRandom
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ