Static task
static1
General
-
Target
1abged1i39.exe
-
Size
3.1MB
-
MD5
d97305eff8d30d298254ee54150893e0
-
SHA1
6b8d2cf01c818a8cdc45996f324d65e35d103f35
-
SHA256
f64e0760122511195c89dc0db30cf3b0e61945754fb7e255da3f88061812750f
-
SHA512
3e592ac43ed73c3ccd48d2b7e57699cd87aa454a36e8ddfe7dcbed062177e925f7d038d44b5461bd1994a0384c04fd138ccd1d442558dbe578671cf4b0321acf
-
SSDEEP
49152:b6dcrhCcHeTtOCEJ16OPXunnnQ5ERj9mlWeiYCgs3NNn1KMOGzZzQRKpDZl7TJBu:b6d+Cc2tOCE3h89e9s9Nn1/IKjBu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1abged1i39.exe
Files
-
1abged1i39.exe.exe windows:6 windows x64 arch:x64
Password: alikarav23
34a79e286e4076ee6e668ee40b6d84dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualQueryEx
WriteProcessMemory
VirtualFree
GetCurrentProcess
GetStdHandle
VirtualAlloc
TerminateProcess
MultiByteToWideChar
Sleep
GetConsoleMode
AttachConsole
GetCurrentThread
CreateThread
Module32FirstW
VirtualAllocEx
ExitProcess
ReadProcessMemory
GetCurrentProcessId
WideCharToMultiByte
GetConsoleWindow
CreateRemoteThread
Module32NextW
AllocConsole
SetConsoleTitleW
IsDebuggerPresent
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
LocalFree
HeapReAlloc
DeleteFileW
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
SetFilePointerEx
GetFileAttributesExW
GetExitCodeProcess
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
WriteFile
ExitThread
CreateProcessW
GetModuleHandleExW
ReadFile
RaiseException
RtlPcToFileHeader
RtlUnwindEx
WaitForSingleObject
LoadLibraryW
UnregisterWaitEx
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
LocalAlloc
GlobalUnlock
QueryPerformanceFrequency
OpenProcess
CreateFileW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
GetVersionExW
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
GlobalLock
GlobalFree
QueryPerformanceCounter
GlobalAlloc
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
RtlUnwind
DeviceIoControl
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
IsProcessorFeaturePresent
GetLastError
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
user32
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
IsChild
UpdateWindow
FindWindowA
GetCursorPos
GetCapture
ScreenToClient
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
mouse_event
CloseClipboard
OpenClipboard
EnumWindows
IsWindowVisible
ClientToScreen
CreateWindowExW
TranslateMessage
FindWindowExW
RealGetWindowClassW
GetWindowTextW
GetMessageW
DefWindowProcW
GetWindowRect
SetLayeredWindowAttributes
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
SetTimer
MessageBoxA
MoveWindow
gdi32
CreateSolidBrush
shell32
ShellExecuteA
d3d9
Direct3DCreate9
dwmapi
DwmExtendFrameIntoClientArea
xinput1_4
ord4
ord2
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
wininet
InternetOpenA
InternetReadFile
InternetOpenUrlA
crypt32
CryptBinaryToStringA
ws2_32
inet_ntoa
gethostbyname
WSAStartup
WSAGetLastError
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 913KB - Virtual size: 913KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wfewfef Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ