Static task
static1
Behavioral task
behavioral1
Sample
buildz.exe
Resource
win11-20240611-en
General
-
Target
buildz.exe
-
Size
820KB
-
MD5
2ec07fb2b4b8511cc61beab303b67f2e
-
SHA1
d6709a93d5d92e978c49fba1744b4707937c2cb8
-
SHA256
b005b4efdf934a10fe8c0db13792ebd4f98eac1a92cea6ff45515f8b07684aec
-
SHA512
55d6ed9faf60c787561d29088288fca23cc23a18758940f351ee750f036f81e7041101f5a78f362a085e89898f8f312f9df558eeca406abb152db57defcd384e
-
SSDEEP
24576:2hpkfViWtBiEDDtrsd23ejJX5fMzhSOparLO:2EVbiEDYKejfoh1par
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource buildz.exe
Files
-
buildz.exe.exe windows:5 windows x86 arch:x86
a513929f6d508044e000a112afe4c1e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalMemoryStatus
FindResourceA
IsBadStringPtrW
GetCPInfo
LoadLibraryExW
GetConsoleAliasA
GetComputerNameW
GetTickCount
GetUserDefaultLangID
SetProcessPriorityBoost
GlobalAlloc
GlobalFindAtomA
LoadLibraryW
GlobalUnlock
GetLastError
SetLastError
GetProcAddress
BuildCommDCBW
GetDiskFreeSpaceW
LoadLibraryA
OpenMutexA
InterlockedExchangeAdd
CreateHardLinkW
FindFirstVolumeMountPointW
GetNumberFormatW
FoldStringW
EnumResourceTypesW
GetModuleFileNameA
GlobalUnWire
lstrcatW
OutputDebugStringA
TerminateJobObject
GetWindowsDirectoryW
OpenFileMappingA
WriteProcessMemory
HeapFree
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
IsProcessorFeaturePresent
HeapCreate
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
Sleep
WideCharToMultiByte
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RaiseException
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sections
.text Size: 625KB - Virtual size: 625KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 170KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ