C:\lab32\valid\valid.pdb
Static task
static1
Behavioral task
behavioral1
Sample
76bdeea9dddc689b4471ee0f5461fd6fe159eb4a7e9d82345d11d8d2df24aa1e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
76bdeea9dddc689b4471ee0f5461fd6fe159eb4a7e9d82345d11d8d2df24aa1e.exe
Resource
win10v2004-20240226-en
General
-
Target
76bdeea9dddc689b4471ee0f5461fd6fe159eb4a7e9d82345d11d8d2df24aa1e
-
Size
588KB
-
MD5
1aa620d96f18fccc904691353acf6e09
-
SHA1
b2752bbb0bf4938eaade248c0a1a0ccd27e3d5a7
-
SHA256
76bdeea9dddc689b4471ee0f5461fd6fe159eb4a7e9d82345d11d8d2df24aa1e
-
SHA512
800977c1787285f420013eb4f1f3892fbf6dba26cdd306a6ac89500bbbe162d6859789143c3da44304b8a8a187041409ea9e5a297f61726ec05e6b1cb21994e4
-
SSDEEP
12288:S7ja7muxQdXWbFSrAotEasNlPiBTjELKkYJG357ivk5d:UBXWxmgidjEjYbAd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76bdeea9dddc689b4471ee0f5461fd6fe159eb4a7e9d82345d11d8d2df24aa1e
Files
-
76bdeea9dddc689b4471ee0f5461fd6fe159eb4a7e9d82345d11d8d2df24aa1e.exe windows:5 windows x86 arch:x86
5bd912e1bff40621ead970b19a1198b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocalTime
DeleteFileA
CopyFileA
FindClose
MoveFileA
FindFirstFileA
GetModuleHandleW
Sleep
InterlockedIncrement
InterlockedDecrement
GetProcAddress
ExitProcess
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetLastError
CloseHandle
MultiByteToWideChar
ReadFile
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetCurrentThread
GetModuleFileNameA
WriteFile
GetStdHandle
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
HeapValidate
IsBadReadPtr
DeleteCriticalSection
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
DebugBreak
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
LoadLibraryW
SetStdHandle
SetHandleCount
GetStartupInfoA
SetFilePointer
CreateFileA
CreateFileW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetLocaleInfoW
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
GetTimeFormatA
GetDateFormatA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
lstrlenA
VirtualQuery
CompareStringA
CompareStringW
SetEnvironmentVariableA
InitializeCriticalSection
InterlockedCompareExchange
Sections
.text Size: 478KB - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ