Static task
static1
General
-
Target
gbl.exe
-
Size
57.2MB
-
MD5
57f1b3d41b8c8dd23c6f79e768f6940d
-
SHA1
c1f6fcb6ad928cdfeb4de544d54a3629ea340290
-
SHA256
0763b4ec17cb6a88290a2062b8b69907876e2c274c51545334acf23e188a28a2
-
SHA512
5e20a8d322d84f05f24a2dbe819ffbdca312bde0416f8156f1765214fa3209efaf6f9be11779b5a44f0dab6c5fa3d00774a526eb84469eb17d144ce3f04656e3
-
SSDEEP
1572864:/nusTsYeDdJwLuHMqkYkFJ7pX2CdvHzmgCeDHN:/n145zkZJ78CRTmgCe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gbl.exe
Files
-
gbl.exe.exe windows:6 windows x64 arch:x64
3312e601730bd9756217b26670b710fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
ws2_32
__WSAFDIsSet
user32
SetClipboardData
advapi32
GetLengthSid
crypt32
CryptProtectData
wintrust
WinVerifyTrust
winhttp
WinHttpGetIEProxyConfigForCurrentUser
kernel32
UnhandledExceptionFilter
shell32
ShellExecuteA
mswsock
AcceptEx
bcrypt
BCryptOpenAlgorithmProvider
ntdll
RtlCaptureContext
imm32
ImmReleaseContext
xinput1_4
ord4
Sections
.text Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 49.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 57.1MB - Virtual size: 57.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ