Static task
static1
Behavioral task
behavioral1
Sample
Epathobj_Exp32.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Epathobj_Exp32.exe
Resource
win10v2004-20230703-en
General
-
Target
Epathobj_Exp32.exe
-
Size
54KB
-
MD5
e2004ec5fef378b2e41f6eef6931650b
-
SHA1
ed86ff44bddcfdd630ade8ced39b4559316195ba
-
SHA256
93e9edf79aab3345edc1ad6007f6f2fabccefc0cab54ce11be7c3fdfa68fbc08
-
SHA512
820c7b3be7bc5195e4d0d843c1c3aab181a961e875c28431db7c45b65004b10802049848d1faf76b935d6d24f5b079bffb224bce00068dff67a63d0808edb4aa
-
SSDEEP
768:EQPGLbT4oe0LSaEMtZddaF3k/+3LcNKBcUWOtK338CsWjcdFwuCsmJ:VGLLSOZe3pcUOMCsWjcdF+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Epathobj_Exp32.exe
Files
-
Epathobj_Exp32.exe.exe windows x86
f3c6f35de02626e44f833718d6b94f7c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseMutex
CreateThread
GetCurrentThreadId
WriteConsoleW
SetStdHandle
CloseHandle
CreateMutexA
LoadLibraryA
VirtualAlloc
GetProcAddress
InterlockedExchange
WaitForSingleObject
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
SetLastError
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapSize
HeapReAlloc
LCMapStringW
CreateFileW
user32
GetDC
ReleaseDC
gdi32
DeleteObject
FlattenPath
PolyDraw
EndPath
CreateRoundRectRgn
BeginPath
shell32
ShellExecuteA
ntdll
NtQueryIntervalProfile
NtReadVirtualMemory
NtQuerySystemInformation
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ