pathping.pdb
Static task
static1
1 signatures
General
-
Target
PATHPING.EXE
-
Size
20KB
-
MD5
30a75901664ff9eb870b68d9364ceb8a
-
SHA1
83389dddd22045b608f542ba075e46f16cfca7c7
-
SHA256
348fb606016a1d9d7a1791a2fd561cf58b2b22165cf3c204ff9c541911078f59
-
SHA512
2ef1de3037b5ef64657cf08b93447fdcd33eaf699963c50c053e56698c952f4740f9aecd7c9b9d16149c41f4affb4952b146db83a765a944b3823c596b6676f1
-
SSDEEP
384:3oRw9uj+d7UNlmEl8ZKrgdIhjSD30o+n/69m4L8SCv/WVAW:YRwgbBlDfSD30/6I4L84
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PATHPING.EXE
Files
-
PATHPING.EXE.exe windows:10 windows x64 arch:x64
Password: infected
527f94868035a5efb9b24dfa6322f29d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
_exit
_initterm
__setusermatherr
_cexit
__wgetmainargs
_amsg_exit
fgetpos
__set_app_type
?terminate@@YAXXZ
memcpy
exit
_fmode
_commode
fwprintf
_XcptFilter
wcstoul
__C_specific_handler
__iob_func
_get_osfhandle
_wcsicmp
fflush
_setmode
_write
_fileno
wcschr
memset
api-ms-win-core-localization-l1-2-0
FormatMessageW
SetThreadUILanguage
iphlpapi
Icmp6ParseReplies
IcmpSendEcho2
Icmp6SendEcho2
IcmpCreateFile
Icmp6CreateFile
IcmpCloseHandle
IcmpParseReplies
ws2_32
WSACleanup
WSAStartup
FreeAddrInfoW
GetNameInfoW
WSAIoctl
GetAddrInfoW
socket
closesocket
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
ntdll
RtlIpv4StringToAddressW
api-ms-win-core-heap-l1-1-0
HeapSetInformation
api-ms-win-core-synch-l1-1-0
SleepEx
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentVariableW
api-ms-win-core-console-l1-1-0
GetConsoleMode
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-file-l1-1-0
GetFileType
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ