Static task
static1
Behavioral task
behavioral1
Sample
表格6015.exe.0805.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
表格6015.exe.0805.exe
Resource
win10v2004-20240802-en
General
-
Target
表格6015.exe.0805.patch
-
Size
277KB
-
MD5
d478c0d9191db231366c15dfcbe47543
-
SHA1
ddae078fd1e77f8cbb274a77537b88cac100d478
-
SHA256
2461fbae859a590de4310f655d540c4285936c3882765b4f687d62e71d628f32
-
SHA512
4154918068bc298fa2ac2856d313cc7e5dff3b29ecad97a893a849bd74e06fc0a12d813cb777d55d6a926b03ffabd8d1b082ad7c6a7e61aede2ca213b05c9242
-
SSDEEP
6144:p5T+HWS/iFMpG5HCTQZ+GustD+/E0nC/Q3S6adl:p5gW2i2pGfDJ0C/V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 表格6015.exe.0805.patch
Files
-
表格6015.exe.0805.patch.exe windows:5 windows x64 arch:x64
5a3e01d85678a781904ae0c97b3080a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleFileNameW
MoveFileExW
SetEndOfFile
CreateFileW
CreateProcessW
CloseHandle
GetFileAttributesW
ExitProcess
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
FreeLibrary
SetConsoleCtrlHandler
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineW
GetStartupInfoW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
HeapAlloc
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
TerminateProcess
GetCurrentProcess
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
FatalAppExitA
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
GetProcessHeap
user32
MessageBoxW
advapi32
RegOpenKeyExW
RegCloseKey
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ