Static task
static1
Behavioral task
behavioral1
Sample
Startupe.exe
Resource
win7-20240704-en
General
-
Target
Startupe.exe
-
Size
71.8MB
-
MD5
daf667184d5cba62af61a4e741287b57
-
SHA1
b92d446db562a22f2f7f2a52a1612f3191a254fb
-
SHA256
c4c999e441d4a7f45a958a434b609ea34f697e7e2d1ad19e01330386156a6954
-
SHA512
722792c895c00593a8775a3cc8dae4145974bda4f3346793cc86e208ef645dc61584b0a1c758adc1b75692e3d64c5372f8f8043b5404d7d0ba83aaee02914570
-
SSDEEP
1572864:OGsn/S/XjSHykGOXJGsn/S/XjSHykGOX:8nMSSklnMSSk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Startupe.exe
Files
-
Startupe.exe.exe windows:6 windows x64 arch:x64
0702c0ba8eb02f14cc11aa3a5d5a197e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryW
GetComputerNameA
VerifyVersionInfoW
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
VirtualProtect
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
CreateProcessA
Sleep
GetEnvironmentVariableW
GetProcessHeap
VerSetConditionMask
FindFirstFileExW
FindClose
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
RtlUnwind
user32
GetMessageW
LoadIconW
MessageBoxW
GetClientRect
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
gdi32
SetBkColor
CreateSolidBrush
CreateFontW
SetTextColor
shell32
SHGetFolderPathW
SHGetFolderPathA
ShellExecuteW
urlmon
URLDownloadToFileW
Sections
.text Size: 324KB - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 71.3MB - Virtual size: 71.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ