D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
Behavioral task
behavioral1
Sample
JK KiNG reWASD by PASS.exe
Resource
win7-20231215-es
Behavioral task
behavioral2
Sample
JK KiNG reWASD by PASS.exe
Resource
win10v2004-20231215-es
General
-
Target
JK KiNG reWASD by PASS.exe
-
Size
5.8MB
-
MD5
cc4bf181fbf6c72c8794f7a8642596e1
-
SHA1
ff108dcdc844f1b3863bb8ef3a0c23334db78700
-
SHA256
7da4e7645b6022f8116dbbf7fb0c4b9f95b283bf51fb7b6173ea32165d55cae9
-
SHA512
b8ed579f0c19ab0f04168a8e50bf967a5e67a9b9f63819f7565055e223efdc3e49086a6342b4b733ea45d37a32d51c8fa2185ef4aee984987f9c24e671200231
-
SSDEEP
49152:NZ85H3qFRglaA+NOpXm1mnj0cP+DkhMAiawnFsZsAZsg343BeioVm3DiRHzZsuk8:QqFCf+QgUwuI33oTtAEnshUe
Malware Config
Signatures
-
AgentTesla payload 1 IoCs
resource yara_rule sample family_agenttesla -
Agenttesla family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JK KiNG reWASD by PASS.exe
Files
-
JK KiNG reWASD by PASS.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 4.8MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 696KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE