C:\dozad.pdb
Static task
static1
Behavioral task
behavioral1
Sample
875c34baceede8781ef8665c6c23fe87.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
875c34baceede8781ef8665c6c23fe87.exe
Resource
win10v2004-20231222-en
General
-
Target
875c34baceede8781ef8665c6c23fe87
-
Size
262KB
-
MD5
875c34baceede8781ef8665c6c23fe87
-
SHA1
98968e3618bb96af535485e0668bd44e70086e8f
-
SHA256
7c649e477b478084993bfaa6afc1b354c78059a8d71d1c5ea43210fabcb62254
-
SHA512
02b44f683039bd40968bd4b9331551cd7123e5c37a750c877587da45dd61c8489fc336e7e25ebc3a9bc2768e541cde357ab79ee9a3711c50a3ba5980ae033522
-
SSDEEP
6144:MWBF2sZolI1h/T25PPgT8B9nhNtgmDczZR6:MW36l4higTQvtgmD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 875c34baceede8781ef8665c6c23fe87
Files
-
875c34baceede8781ef8665c6c23fe87.exe windows:5 windows x86 arch:x86
6c073e6a8ba68224cd3b694cbab6f2b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GlobalFix
HeapReAlloc
lstrlenA
WritePrivateProfileStructA
GetModuleHandleExA
SetLocalTime
GetDriveTypeW
SetEndOfFile
InterlockedIncrement
_lwrite
CreateDirectoryW
GetProfileSectionA
SetVolumeMountPointW
OpenSemaphoreA
GetModuleHandleW
ReadConsoleW
EnumTimeFormatsA
CreateActCtxW
CreateDirectoryExW
GetPriorityClass
GlobalAlloc
GetVolumeInformationA
LoadLibraryW
GetConsoleMode
Sleep
ReadConsoleInputA
CopyFileW
_hread
GetPrivateProfileStructW
GetVersionExW
GetComputerNameExA
SetConsoleMode
Beep
SetConsoleCursorPosition
WriteConsoleW
GetBinaryTypeA
WritePrivateProfileSectionW
TerminateProcess
GetAtomNameW
ReadFile
GetModuleFileNameW
CreateFileW
GetOverlappedResult
CompareStringW
FillConsoleOutputCharacterA
VerifyVersionInfoW
FindFirstFileA
OpenMutexW
GetHandleInformation
GetLastError
IsDBCSLeadByteEx
GetCurrentDirectoryW
GetThreadLocale
ReadConsoleOutputCharacterA
GetProcAddress
IsValidCodePage
CopyFileA
SetComputerNameA
BuildCommDCBW
ResetEvent
ProcessIdToSessionId
UnhandledExceptionFilter
OpenWaitableTimerW
LocalAlloc
GetFileType
AddAtomW
SetCurrentDirectoryW
GetCommMask
SetSystemTime
SetEnvironmentVariableA
WTSGetActiveConsoleSessionId
SetConsoleTitleW
FreeEnvironmentStringsW
RequestWakeupLatency
CompareStringA
GetCPInfoExA
SetCalendarInfoA
_lopen
ReadConsoleInputW
LocalSize
TlsFree
LCMapStringW
CopyFileExA
CloseHandle
SetStdHandle
GetConsoleCP
SetFilePointer
RaiseException
GetACP
GetTempFileNameW
MoveFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
InterlockedDecrement
DecodePointer
ExitProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
WriteFile
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapValidate
IsBadReadPtr
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
HeapCreate
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapAlloc
GetModuleFileNameA
HeapSize
HeapQueryInformation
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
OutputDebugStringA
OutputDebugStringW
IsProcessorFeaturePresent
FlushFileBuffers
user32
GetCursorInfo
GetListBoxInfo
GetComboBoxInfo
GetMenuBarInfo
advapi32
AdjustTokenPrivileges
Exports
Exports
_CallPattern@8
Sections
.text Size: 171KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ