Static task
static1
Behavioral task
behavioral1
Sample
PwDump.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PwDump.exe
Resource
win10v2004-20230915-en
General
-
Target
PwDump.exe
-
Size
384KB
-
MD5
7a198abd552a68832b90688cba249b5e
-
SHA1
69d05825b1fb1e46f797efb09acdb1d2c7a1c1c9
-
SHA256
446f84069e825062d1d56971b7578361ebc4feb1988950701065d9c18a3e7941
-
SHA512
b2108b233b62661db5e560d34b1f42a66b90aee28f6e7b64189069e07bb48792760491316045678bdae33280e00685eda34a153b656de46afed468ecdce3b94b
-
SSDEEP
6144:mwSQhDjdSqoIRY6jIuQ5dOuxx3LoWVp7wQzMff70VPlhWSHXK:DSQ/zY6suQPLughWd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PwDump.exe
Files
-
PwDump.exe.exe windows:5 windows x86
13f08707f759af6003837a150a371ba1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetAddConnection2A
WNetCancelConnection2A
netapi32
NetApiBufferFree
NetShareGetInfo
NetShareEnum
kernel32
GlobalReAlloc
GlobalAlloc
ReadFile
SetNamedPipeHandleState
CreateFileA
Sleep
GetLastError
WaitNamedPipeA
DeleteFileA
GlobalFree
WaitForSingleObject
CloseHandle
CopyFileA
GetModuleFileNameA
GetCurrentDirectoryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
InitializeCriticalSection
QueryPerformanceCounter
SetHandleCount
SetStdHandle
HeapSize
IsValidLocale
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
RtlUnwind
ExitThread
GetCurrentThreadId
CreateThread
HeapAlloc
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetCommandLineA
CreateFileW
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetConsoleCP
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
user32
wsprintfA
advapi32
CreateServiceA
OpenServiceA
StartServiceA
QueryServiceStatus
DeleteService
CloseServiceHandle
OpenSCManagerA
ole32
CoCreateGuid
StringFromGUID2
Sections
.text Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ