Static task
static1
General
-
Target
R6Chamsv2.exe
-
Size
3.0MB
-
MD5
8392948bf7ebdb0726dd6a6e4dd0c6df
-
SHA1
ac65d04386e5fc81dc92c2e00e12db3463c62418
-
SHA256
42b8658bd9e5d77280ff7dd1cfc91905639778c28d6d71c8bef0f4b22f9ff48f
-
SHA512
6f5f146cda6fd02e8bf4a3c692db2844d7cc10d28a7bc014510616d030c4c474a91ab82a49f87f7204f40d1130d98ae938783548c5c5b42a9a186b7e2f99bd03
-
SSDEEP
98304:Fhfls59l66Bc8UUk3E0mlGCsR9MXJ5Gwz:Fh2qvUk36WR25tz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource R6Chamsv2.exe
Files
-
R6Chamsv2.exe.exe windows:6 windows x64 arch:x64
0ce0e896b6a04da8afe27a902d89872e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryFullProcessImageNameW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWinEventHook
msvcp140
_Query_perf_frequency
crypt32
CertEnumCertificatesInStore
normaliz
IdnToAscii
wldap32
ord211
ws2_32
select
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
httpapi
HttpCreateRequestQueue
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
advapi32
SetSecurityInfo
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ