C:\lihedoyeyusun\pezigekoyipu\herubodojog.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51.exe
Resource
win10v2004-20231222-en
General
-
Target
4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51
-
Size
172KB
-
MD5
5a14e0ef81ea15e9afd4defdeaa840ae
-
SHA1
a2a477a36236e38ca0140e3f751006a624f142ef
-
SHA256
4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51
-
SHA512
ffb8a416fd0e8e39cc8cbab881c2f22edb03948665d2cb63dc6ccb83e56f64b22a0c837257beda076877e8d8d00588a9bdd8b4f8571deae11da2fe8503f87b01
-
SSDEEP
1536:s/lLWqbPoATxKPTPCl+X8KY9/JOed/ohT6NxAMQ854URociX4Q2jw/mb3rU9:s/lLW2PoAp/xZdd/vsXQ4URoQM/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51
Files
-
4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51.exe windows:5 windows x86 arch:x86
54dc4fa00aed2dfea3bfa727027b942d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocaleInfoW
FormatMessageW
GetExitCodeProcess
GetFileAttributesW
CreateFileW
lstrlenW
WritePrivateProfileStringW
GetNamedPipeHandleStateW
LCMapStringA
GlobalAlloc
GetLastError
GetProcAddress
RemoveDirectoryA
OpenWaitableTimerA
CreateHardLinkW
GetPrivateProfileSectionA
GetCurrentProcessId
GetCurrencyFormatW
SetCommTimeouts
WriteFile
GetModuleHandleW
SleepEx
GetDriveTypeW
IsBadStringPtrW
FindFirstFileExA
FindResourceA
Sleep
ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
GetLocaleInfoA
WideCharToMultiByte
HeapAlloc
VirtualAlloc
HeapReAlloc
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringW
advapi32
LookupAccountNameA
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ