H:\D\Misha\bho\runexpl\runexpl\Release\smphost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9735bb8fb350c293703771b9fabb0b7a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9735bb8fb350c293703771b9fabb0b7a.exe
Resource
win10v2004-20231222-en
General
-
Target
9735bb8fb350c293703771b9fabb0b7a
-
Size
352KB
-
MD5
9735bb8fb350c293703771b9fabb0b7a
-
SHA1
d3de1fe398fcd3e7a50834769cb8aca01ca071f7
-
SHA256
40b894d13b0a47a5a9ce574ad4594fb3224b12a18614a19c403e55c79a46ff54
-
SHA512
94c3a63c4b105485d413a3ca68a3f960e49729b50faf84788738f36bbcf934c823e9f3bad945f0fcf45e45b1713f9c62f78a30d5ab07e9a3e9cfdac941bdc6a0
-
SSDEEP
6144:3VNHVj19FQV3Ywv/+bqMLTMt6DtL5/AYmQZfgIPkLZ4Qcca3XMlO0pu:bVRHwv/+at65F4Y/1kLIMc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9735bb8fb350c293703771b9fabb0b7a
Files
-
9735bb8fb350c293703771b9fabb0b7a.exe windows:5 windows x86 arch:x86
6e822ff8658b9604360812988c84f803
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
GetProcessImageFileNameW
GetModuleFileNameExW
kernel32
CreateToolhelp32Snapshot
Thread32First
Thread32Next
LocalFree
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
CreateFileW
GetFileSize
ReadFile
GetLastError
WriteFile
OpenSemaphoreW
WaitForSingleObject
CreateProcessA
ReleaseSemaphore
GetModuleFileNameW
CreateProcessW
OpenProcess
CreateEventW
CancelIo
GetOverlappedResult
CreateNamedPipeA
DisconnectNamedPipe
ConnectNamedPipe
SetEvent
GetVersionExA
Sleep
MultiByteToWideChar
TerminateThread
SetThreadPriority
GetExitCodeThread
ResumeThread
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
SetFilePointer
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
CreateFileA
LCMapStringW
WideCharToMultiByte
LCMapStringA
LoadLibraryA
SetProcessAffinityMask
GetSystemInfo
GetCurrentProcess
GetPriorityClass
CloseHandle
CreateSemaphoreW
HeapFree
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
InterlockedIncrement
InterlockedDecrement
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
RaiseException
RtlUnwind
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
user32
CharLowerW
GetParent
GetWindowInfo
SetWindowPos
SystemParametersInfoW
GetWindowPlacement
EnumWindows
FindWindowExW
GetWindowThreadProcessId
EnumThreadWindows
IsWindow
PostMessageW
SendMessageW
GetWindowRect
GetKeyState
EnumChildWindows
GetWindowTextW
GetClassNameW
advapi32
InitializeSecurityDescriptor
GetUserNameW
RegSetValueExW
RegCreateKeyExW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
ws2_32
WSACleanup
gethostbyname
WSAStartup
Sections
.text Size: 259KB - Virtual size: 258KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ