Static task
static1
General
-
Target
X-mas_2.3.2.exe
-
Size
318KB
-
MD5
3dfd44f9df3a6c7b1d20a12a20ba0c67
-
SHA1
a0fb2858b35965912b61b82cb575590bb5a401c7
-
SHA256
a1378c290f4fa41011aed872439a21dba2604a9b1e48a53bcc518d4d101d4da8
-
SHA512
be4acb1c27848e5cfaffa6d662e4515913530801f01504fccb9a8002c92d9a0ec9d80028e0803bf5fee92c801323ac5492167dff226461551407b938dbff77e1
-
SSDEEP
6144:TrKgLPGKlEi1dSEdDNN5LC/hNTYTFzZHzvXJmrzJpBtaAuGRxhGaq:TrFLdlEijSEddG/7cVZTkRtaAuGRxhA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource X-mas_2.3.2.exe
Files
-
X-mas_2.3.2.exe.exe windows:5 windows x86 arch:x86
4b7ccee94e7fc8dc791130d5e1bad514
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLogicalDriveStringsW
WriteConsoleInputA
EnumCalendarInfoExW
FindNextVolumeMountPointA
EscapeCommFunction
GetWindowsDirectoryA
EnumTimeFormatsW
GetProcessHandleCount
GetVersionExW
LCMapStringA
InterlockedExchange
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
EnumSystemCodePagesW
SetComputerNameA
GetCurrentProcess
LoadLibraryA
InterlockedExchangeAdd
OpenEventA
GlobalWire
EnumDateFormatsA
GetModuleHandleA
SetLocaleInfoW
FreeEnvironmentStringsW
FindNextFileW
GetShortPathNameW
ReadConsoleInputW
TerminateJobObject
HeapSize
WriteConsoleW
InterlockedIncrement
InterlockedDecrement
GetAtomNameA
EnumCalendarInfoA
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
HeapReAlloc
HeapAlloc
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
HeapCreate
VirtualFree
CloseHandle
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ReadFile
CreateFileA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
GetWindowTextLengthA
DdeQueryStringW
GetKeyboardType
GetComboBoxInfo
GetMenuItemID
gdi32
CreateCompatibleBitmap
advapi32
ReadEventLogW
shell32
DragQueryPoint
ole32
CoRegisterPSClsid
winhttp
WinHttpCheckPlatform
WinHttpSetDefaultProxyConfiguration
Sections
.text Size: 275KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ