Static task
static1
Behavioral task
behavioral1
Sample
windows.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
windows.exe
Resource
win10v2004-20241007-en
General
-
Target
windows.zip
-
Size
87KB
-
MD5
6cecebc76efd45fcfa7cfbec5f383150
-
SHA1
aa6808022d241e61c0571b428763d5ad8ca81918
-
SHA256
f9bb467ddbc18aba13667abe99d2289d7c799c289aae1158e8f7460531bd56b7
-
SHA512
bb48ae282f51ef2d9361abc99841fac73124a1dd9bf1c8ffec2f44ce0ef40a0191da9ee630a05a82a1856d81a5f9f4bd9b06a8075efa0edaeb38692c1b9f9fd1
-
SSDEEP
1536:+EI0PWCSnmVULuvvUGaefV0fRNggB1h0h8rrUdA0laGqMJ+5cA4HYzbP00lh:+pGNQLuvsGaK0ZNgo88rodA0laGqMo5b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/windows.exe
Files
-
windows.zip.zip
Password: infected
-
windows.exe.exe windows:6 windows x86 arch:x86
Password: infected
90ebed3b33e7dd54f57e05f02969e6cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptStringToBinaryA
rstrtmgr
RmStartSession
RmShutdown
RmEndSession
RmRegisterResources
RmGetList
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
kernel32
FindNextVolumeW
GetDriveTypeW
ReadFile
GetFileSizeEx
SetFileTime
GetQueuedCompletionStatus
GetFileAttributesW
SetFileAttributesW
lstrcpyA
MoveFileExW
CreateIoCompletionPort
GetCurrentProcess
TerminateProcess
WaitForMultipleObjects
SetEndOfFile
GetTempPathW
OpenProcess
lstrcpyW
CreateToolhelp32Snapshot
FormatMessageW
GetTickCount64
FindNextFileW
Process32FirstW
GetSystemInfo
SetFilePointerEx
LocalFree
GetCurrentProcessId
FormatMessageA
GetFileTime
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetVolumeMountPointW
CreateThread
CloseHandle
lstrcatW
Sleep
CreateFileW
WaitForSingleObject
FindClose
DeviceIoControl
WriteFile
PostQueuedCompletionStatus
GetACP
IsValidCodePage
FindFirstFileExW
DecodePointer
GetFileType
FindFirstVolumeW
FindFirstFileW
GetProcessHeap
HeapAlloc
lstrlenA
HeapFree
lstrcmpiW
GetLastError
GetCommandLineW
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
WriteConsoleW
lstrlenW
Process32NextW
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
CompareStringW
user32
SystemParametersInfoW
ReleaseDC
GetSystemMetrics
GetDC
DrawTextA
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
GetTextExtentPoint32A
CreateCompatibleDC
CreateFontW
DeleteDC
SetTextColor
SetBkMode
SetBkColor
DeleteObject
winspool.drv
EnumPrintersW
WritePrinter
ClosePrinter
StartPagePrinter
EndDocPrinter
StartDocPrinterW
OpenPrinterW
EndPagePrinter
advapi32
SetEntriesInAclW
QueryServiceStatusEx
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
RegOpenKeyW
SetNamedSecurityInfoW
ControlService
EnumDependentServicesW
RegSetValueExW
OpenProcessToken
FreeSid
EnumServicesStatusExW
OpenServiceW
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
Sections
.text Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ