C:\Users\11502\Desktop\SharpWeb-main\SharpWeb\obj\Debug\SharpWeb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675.exe
Resource
win10v2004-20231215-en
General
-
Target
54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675.exe
-
Size
399KB
-
MD5
45fd9224d365376207bc0d6a562cf39e
-
SHA1
4454eb8eed1b6a0c15873b60bbf8dd09dcb10e6c
-
SHA256
54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675
-
SHA512
a4f9616285249f821714ac40b6188400624922384aee990535ee29b9ed61ffef67ddc5533f6c4a10cc76fdcac790b5bc613638ba5f3a479e108cbe46982ee683
-
SSDEEP
6144:wjfeAkLUmv95G6HzHtZmIYEaWBx36V0JQQQma6QszRUQzUKyerReCVrK/EtbSbI+:wjfnkjv26TNZmFq36+xa6QS1tR8Iyn2
Malware Config
Signatures
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675.exe
Files
-
54bb4aad5fef1e32777c2165a0ca9a7920d9029b7fbbe3886e06932a8db21675.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 397KB - Virtual size: 396KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ