Static task
static1
General
-
Target
Defender 4.exe
-
Size
36.8MB
-
MD5
3e8aded5f1b9fc145a227d430bd46c5f
-
SHA1
054d5a1c92024a16bcbf9b9c76529e43500962f6
-
SHA256
941acd3d80db2685040d0f3478f96639637c95368939fd26589d6895fc60cc02
-
SHA512
9b67387152f3463e07c1f5db951e857c283a10b23084a1d546afe79814c79c2f423367f548ca355ae260ba4e3176940919aeb6266e5ccfa06b49113f13c71a50
-
SSDEEP
786432:s3F6o9oIxYJq37ruw0/zT9GiJ0rDeeUqz6mvKg+zu:aNPxYJq3RU9GrbUqz6m7+zu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Defender 4.exe
Files
-
Defender 4.exe.exe windows:6 windows x64 arch:x64
222c8dd0c34a401c1364d258e0175df2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
ReadProcessMemory
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
ReleaseCapture
advapi32
RegDeleteKeyA
libcurl
curl_easy_init
imm32
ImmReleaseContext
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtQuerySystemInformation
dbghelp
ImageDirectoryEntryToData
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: - Virtual size: 599KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 816KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.s$O Size: - Virtual size: 22.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.08] Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.6_a Size: 36.8MB - Virtual size: 36.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ