Static task
static1
Behavioral task
behavioral1
Sample
netdump.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
netdump.exe
Resource
win10v2004-20230703-en
General
-
Target
netdump.exe
-
Size
21KB
-
MD5
2ced687629072ede95a2d9d2f484ea52
-
SHA1
5dc671942af8d59ca400e791112af814b2599a5e
-
SHA256
d47d0a9d7dc94a3ab59ca09809a87245d6731cdcb404023b59c4870a9319074b
-
SHA512
f0a2f613adb4efcdb636e7172bcb534d3c12afef46d730c87b71167af562e313a1fec46a3557c291c3a4144f7a049a923de0ab4a70d73e6f11c7cd54fbfb796d
-
SSDEEP
384:Rk79yqmGX8SboP70o3gV35zfYvQEnVnVLWZ8A:S78Z5QDYvQEnNEZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource netdump.exe
Files
-
netdump.exe.exe windows x64
f87765cd1c393cdc34ddc174eadc2b81
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleTextAttribute
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fprintf
free
fwrite
isprint
malloc
memcpy
printf
putchar
signal
strlen
strncmp
vfprintf
windivert
WinDivertHelperCompileFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohl
WinDivertHelperNtohs
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertSetParam
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE