Static task
static1
Behavioral task
behavioral1
Sample
E发票_Setup6029.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
E发票_Setup6029.exe
Resource
win10v2004-20240730-en
General
-
Target
E发票_Setup6029.exe
-
Size
536KB
-
MD5
2ecd9b201dbfe99dc38918e6e5b5c2d8
-
SHA1
02aa4ea7a63d38e89d7e5fb2fe73ca26bcc0edc0
-
SHA256
ea77fca5c283dc72f801acaaf25af124114c61c95cb3fa6e72d0846891b82e8d
-
SHA512
fe5a2622a554e140c0a4f6d62f5068f2ebf4fc5123f10eaaf33a1f93b8d52bdeb22697165940c9b09be5dee86b65f459f1e15a981e6328f1ccaed51de31cab75
-
SSDEEP
12288:+d5CJl2IwXdbSci6nAAAAAAAAAAAAAAAXAbAAAAAAAAAAAAAAAAAAAAAbAAAgAxc:Jl2Iw9S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource E发票_Setup6029.exe
Files
-
E发票_Setup6029.exe.exe windows:5 windows x64 arch:x64
cb2d00b7872d8eee2cba43d2e1793c42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetFileAttributesW
GetModuleFileNameW
MoveFileExW
SetEndOfFile
CreateFileW
CreateProcessW
CloseHandle
ExitProcess
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
FreeLibrary
SetConsoleCtrlHandler
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineW
GetStartupInfoW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
HeapAlloc
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
GetCurrentProcess
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
FatalAppExitA
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
GetProcessHeap
user32
MessageBoxW
advapi32
RegOpenKeyExW
RegCloseKey
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
Sections
.text Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ