Static task
static1
Behavioral task
behavioral1
Sample
PresentMon-1.8.0-x64.exe
Resource
win10v2004-20220812-en
General
-
Target
PresentMon-1.8.0-x64.exe
-
Size
311KB
-
MD5
1f3a9e2b9bbf1788947ebd472b0509f1
-
SHA1
4e0a9951b4db4d7b2664563f6263ffb278ace5d6
-
SHA256
b06f7c48de24b43d5d73f289a95da86c3fe78689db13b72e0fe96535695b7ef9
-
SHA512
e0c832266f25760d0c5e1af6ef8206f3368dfd3f91f8544a5d6042a6fef1fe86bc46fc6d10fac18482060cca7b859c2f731c3572c71d8442d00faf469fc3baee
-
SSDEEP
6144:FB7CAKFacnshr9HBePN/6gEVS1RKp59lPrQ8d35YK:iAKFRg9HBudEVS18N2y
Malware Config
Signatures
Files
-
PresentMon-1.8.0-x64.exe.exe windows x64
75084f6bf4795dbe05bb5df4da31989c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
WriteConsoleOutputCharacterA
SetConsoleCursorPosition
SetThreadPriority
GetCurrentThread
SetConsoleCtrlHandler
LoadLibraryExA
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OpenProcess
QueryFullProcessImageNameA
CloseHandle
DeleteCriticalSection
QueryPerformanceCounter
GetExitCodeProcess
GetModuleFileNameA
GetCurrentProcess
WaitForSingleObject
GetLastError
GetProcAddress
FreeLibrary
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
ReadConsoleW
RtlUnwindEx
RtlPcToFileHeader
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
HeapSize
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
SetFilePointerEx
WriteConsoleW
SetEndOfFile
ReadFile
Sections
.text Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ