C:\Users\Administrator\Documents\Work\DemProject\Output\Loader\Release\Loader_Release_Win32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9.exe
Resource
win10v2004-20240226-en
General
-
Target
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9
-
Size
293KB
-
MD5
83c6f7d8026e3b966329e8c39a2c9e73
-
SHA1
6ec527c03a0e0011dedc82d5996d3801e3b65ed8
-
SHA256
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9
-
SHA512
a72ed320ed189682a23ccafe0302f8cb8c7ce8b8c70a58cf0f2f19a24eb09866b1b894383a5c6bc797be1a051d02cdc087d33ed336ed30ac9036c1c9b1481e03
-
SSDEEP
3072:D3Q9NpCJxUNtjipXFi+PlZlKG6ZEhGFUx+3Ynlhs34jljeLnCQS:DmNMUNdiyoKcwxIwASA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9
Files
-
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9.exe windows:5 windows x86 arch:x86
fd3e67a72fcdc11dae1668a9ef71cd6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
WaitForSingleObject
TerminateThread
CreateDirectoryA
CloseHandle
CreateThread
CreateFileA
GetCurrentProcess
WriteFile
OpenProcess
GetFileAttributesA
CreateProcessA
TerminateProcess
MultiByteToWideChar
SetCurrentDirectoryA
GetLastError
Process32FirstW
IsWow64Process
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
DeleteFileA
SetEndOfFile
CreateFileW
ReadConsoleW
ReadFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
OutputDebugStringW
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
EncodePointer
DecodePointer
GetCommandLineW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
DeleteCriticalSection
HeapSize
RtlUnwind
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
user32
SendMessageW
DispatchMessageW
DefWindowProcW
CreateWindowExW
LoadStringW
LoadIconW
RegisterClassExW
LoadAcceleratorsW
TranslateMessage
EndPaint
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadCursorW
BeginPaint
ws2_32
gethostbyname
closesocket
socket
recv
WSACleanup
htons
WSAStartup
connect
send
Exports
Exports
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ