Static task
static1
General
-
Target
XIII Windows 10 Edition Setup.exe
-
Size
25.6MB
-
MD5
f7401266979763c05a9fe805134e1136
-
SHA1
5454163a377cdd03ddfab18d6099e3b032debfd5
-
SHA256
4cd267d92353ffd99894d65794fc8f50b8a387476b2cac3dfd42d2f78866d0c7
-
SHA512
02c3a6ee53a5beebc178832711b203bfc3516d73da1322d830119d19c0615fb711e9bfc79381195ada79a9f2e81a64d6f7db69d27044699db9354e9482545cce
-
SSDEEP
786432:g0aCoGTU4QERO9hkWxUPUF/k4r7thCp9ytiF:zaCoCO9lyci4lhCK8F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource XIII Windows 10 Edition Setup.exe
Files
-
XIII Windows 10 Edition Setup.exe.exe windows:5 windows x86 arch:x86
1138cbeca737294349f65c9e57494919
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileSize
GetTickCount
GetModuleFileNameW
GetCommandLineW
SetEnvironmentVariableW
GetTempPathW
SetErrorMode
GetCurrentProcess
ExitProcess
GetVersion
GetWindowsDirectoryW
CopyFileW
GetDiskFreeSpaceW
CreateThread
GetModuleHandleW
GlobalLock
lstrcpynW
lstrlenW
CreateDirectoryW
GetTempFileNameW
RemoveDirectoryW
WriteFile
GetLastError
GetPrivateProfileStringW
GetExitCodeProcess
CreateProcessW
GetSystemDirectoryW
GetModuleHandleA
GetProcAddress
lstrcmpiA
lstrcpyA
lstrcatW
MoveFileExW
FreeLibrary
Sleep
CloseHandle
SetFileTime
SetFilePointer
SetFileAttributesW
ReadFile
GetShortPathNameW
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CompareFileTime
SearchPathW
SetCurrentDirectoryW
WritePrivateProfileStringW
ExpandEnvironmentStringsW
lstrlenA
lstrcmpiW
lstrcmpW
MulDiv
GlobalFree
GlobalAlloc
WaitForSingleObject
LoadLibraryExW
GlobalUnlock
user32
EndDialog
CheckDlgButton
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
IsWindowEnabled
GetSystemMetrics
GetSystemMenu
CreatePopupMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
GetWindowRect
SetCursor
ScreenToClient
GetSysColor
GetWindowLongW
SetClassLongW
DialogBoxParamW
LoadCursorW
SystemParametersInfoW
wsprintfA
DispatchMessageW
PeekMessageW
SetDlgItemTextW
GetDlgItemTextW
CharNextA
CharPrevW
MessageBoxIndirectW
CharNextW
ExitWindowsEx
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
LoadImageW
FindWindowExW
SetWindowLongW
ReleaseDC
IsWindowVisible
SetWindowPos
CreateWindowExW
GetClassInfoW
RegisterClassW
CallWindowProcW
LoadBitmapW
GetDC
SetForegroundWindow
EnableWindow
GetDlgItem
ShowWindow
IsWindow
PostQuitMessage
SendMessageTimeoutW
SendMessageW
wsprintfW
FillRect
GetClientRect
EndPaint
BeginPaint
DrawTextW
DefWindowProcW
GetMessagePos
InvalidateRect
gdi32
CreateBrushIndirect
DeleteObject
SelectObject
SetBkMode
SetTextColor
GetDeviceCaps
SetBkColor
CreateFontIndirectW
shell32
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
AdjustTokenPrivileges
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
LookupPrivilegeValueW
SetFileSecurityW
RegCreateKeyExW
comctl32
ImageList_AddMasked
ord17
ImageList_Create
ImageList_Destroy
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 196KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 199KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/modern-wizard.bmp