Static task
static1
General
-
Target
AstroMenu.exe
-
Size
12.1MB
-
MD5
f8d8ffb018a46fe8dfc598cc159c0d2e
-
SHA1
ed622ff4f4bb6ab4d5f8f4019090db903a5d1c63
-
SHA256
0488031b62b3fc3a1a462047fb1419f1fd1f9d4e26af6625dd43210c4280b572
-
SHA512
057c4c06ca775c3a33c3e94e87abd45a77b25381a263c36a2471fdf0b1c909521d5f458c096de319d39890603cd3b4347fec7314a11b28680f4051292f8baa23
-
SSDEEP
196608:cusKOxuIj/Ceu11u7GtlIZItA+H5FwFClGPiOMSmUUhB47Gv83xpyznYr3y:cusRE0/Cet7FUH5FmLPvMSNxP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AstroMenu.exe
Files
-
AstroMenu.exe.exe windows:6 windows x64 arch:x64
c7f5c8ce2f2cfee74dd5c538e4c512e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MapViewOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
MessageBoxA
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
getpeername
rpcrt4
UuidToStringA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
Sections
.text Size: - Virtual size: 423KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.R8} Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.4et Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VNm Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ