Static task
static1
Behavioral task
behavioral1
Sample
Startupe.exe
Resource
win7-20240704-en
General
-
Target
Startupe.exe
-
Size
63.1MB
-
MD5
07953e2689f0fc0c4abd5352fa74d510
-
SHA1
51c31621821a777241af037dd620f25e72af10e0
-
SHA256
fa316ea46fdb86d3a2f1d211fa5b15c221cf3142e398f8a743302f6fbc4dceac
-
SHA512
f5417ad37f1c1d30fffc5048e44e86a7e9321370d0a3f513a022c28497ac897e010090b490aabf66ccd7859b97e9d1d4ded854d8f0a95817e96cd74552fb3aec
-
SSDEEP
786432:3RjOKDYLpWBRjOKDYLpWBRjOKDYLpWBRjOKDYLpWBRjOKDYLpWBRjOKDYLpWS2eW:3JJJJJ62emv4kg7IPNt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Startupe.exe
Files
-
Startupe.exe.exe windows:6 windows x64 arch:x64
Password: infect
6d77297695c769ccf52597daade6551a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryW
lstrcmpiA
lstrcatA
GetComputerNameA
VerifyVersionInfoW
SetEndOfFile
WriteConsoleW
VirtualProtect
CreateFileW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
CreateProcessA
Sleep
GetEnvironmentVariableW
HeapSize
VerSetConditionMask
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
CloseHandle
EnumSystemLocalesW
GetUserDefaultLCID
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapAlloc
HeapFree
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
RtlUnwind
user32
TranslateMessage
GetMessageW
DispatchMessageW
LoadIconW
MessageBoxW
GetClientRect
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
SendMessageW
gdi32
SetBkColor
CreateSolidBrush
CreateFontW
SetTextColor
shell32
ShellExecuteW
SHGetFolderPathA
SHGetFolderPathW
shlwapi
PathIsDirectoryA
PathFindExtensionA
PathFileExistsA
PathAppendA
StrStrA
PathIsRelativeA
PathRemoveFileSpecA
dxgi
CreateDXGIFactory
urlmon
URLDownloadToFileW
Sections
.text Size: 545KB - Virtual size: 545KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 62.4MB - Virtual size: 62.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ