Static task
static1
General
-
Target
mc_rs.exe
-
Size
8.7MB
-
MD5
1cf1cf1f119a4bdd5997963f6a90ae46
-
SHA1
c9b4bbfea8801023e1a8c38b68c7fd3ed2c0bc08
-
SHA256
82ba6ae31feeae03491f6b3d8b3bd5098f2e037cc1dba000c7f48b8972c5dab4
-
SHA512
ac25f0cb3e30c67026e17738978cb689f83293bc18b17fb5e34d3be8d66bbd21b1585fdfde20e008eb1551ce5951a4cec6119dac023a6323d65de7faa9c6b397
-
SSDEEP
98304:wpUW4vkjywgQhvqvAD1b+DAtKzlACgvtlkY/j51SU++v5tf6hvgkyqpbB/8sAt:Y4caMlB+fzl9gVlZj5UU++r6hvlvbO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mc_rs.exe
Files
-
mc_rs.exe.exe windows:4 windows x64 arch:x64
f3f7cc4e832c49fa6798ae2fd9a95f08
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
SystemFunction036
bcrypt
BCryptGenRandom
dwmapi
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
gdi32
CreateRectRgn
DeleteObject
GetDeviceCaps
imm32
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
kernel32
AddVectoredExceptionHandler
CloseHandle
FormatMessageW
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetFileInformationByHandleEx
GetFileType
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTimePreciseAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
LoadLibraryA
LoadLibraryExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetConsoleTextAttribute
SetLastError
SetThreadErrorMode
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SwitchToThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WriteConsoleW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
VirtualProtect
VirtualQuery
__C_specific_handler
ntdll
NtWriteFile
RtlNtStatusToDosError
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
OleInitialize
RegisterDragDrop
RevokeDragDrop
shell32
DragFinish
DragQueryFileW
user32
AdjustWindowRectEx
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseTouchInputHandle
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageW
EnableMenuItem
GetActiveWindow
GetAsyncKeyState
GetClientRect
GetClipCursor
GetCursorPos
GetDC
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageW
GetMonitorInfoW
GetRawInputData
GetSystemMenu
GetSystemMetrics
GetTouchInputInfo
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
InvalidateRgn
IsProcessDPIAware
KillTimer
LoadCursorW
MapVirtualKeyExW
MapVirtualKeyW
MonitorFromRect
MonitorFromWindow
PeekMessageW
PostMessageW
RedrawWindow
RegisterClassExW
RegisterRawInputDevices
RegisterTouchWindow
RegisterWindowMessageA
ReleaseCapture
ScreenToClient
SendMessageW
SetCapture
SetCursor
SetTimer
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
ShowCursor
ShowWindow
SystemParametersInfoA
ToUnicodeEx
TrackMouseEvent
TranslateMessage
ValidateRect
uxtheme
SetWindowTheme
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
_onexit
abort
calloc
ceil
exit
floor
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 704B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ