qwinsta.pdb
Behavioral task
behavioral1
Sample
ba5a65a145289558793bae1965b855a6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba5a65a145289558793bae1965b855a6.exe
Resource
win10v2004-20240226-en
General
-
Target
ba5a65a145289558793bae1965b855a6
-
Size
131KB
-
MD5
ba5a65a145289558793bae1965b855a6
-
SHA1
5d528ec6fcad6a480e1da01effaf74674f273c7a
-
SHA256
be17e1a97ed25df2b61820ea4505a4d3e432909bc242f043f24cfd82d7068c47
-
SHA512
8c596b8d910f9f628bf7d05fed2116983fb78a4a17e31282b54b3d0fc0acb89624dc6ad7e3356fa99c73c601f0d3a57df2df3f45e008c47712256cdb39b9d31c
-
SSDEEP
3072:UjSmfiQDCwywOhPmecbZi6a4n+vX2UJUGlmEM8Txa0p+8pdGw:bfw0PmPbZ17nIGUyGAEMk02+8pdb
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba5a65a145289558793bae1965b855a6
Files
-
ba5a65a145289558793bae1965b855a6.exe windows:5 windows x86 arch:x86
3ca5326fd9f681a823be8aa67e4c1aa9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
winsta
WinStationFreeMemory
WinStationOpenServerW
WinStationGetTermSrvCountersValue
WinStationEnumerateW
WinStationQueryInformationW
utildll
StrAsyncConnectState
StrConnectState
user32
wvsprintfW
CharToOemW
LoadStringW
wsprintfW
kernel32
GetACP
FindFirstFileW
FindNextFileW
lstrcpynW
GetFileAttributesW
GetCommandLineW
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
GetLastError
SetThreadUILanguage
GetConsoleOutputCP
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
MultiByteToWideChar
GetOEMCP
LocalFree
LocalAlloc
FreeLibrary
LoadLibraryW
SetLastError
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleW
FormatMessageW
ntdll
memmove
wcstoul
wcscmp
_wcsnicmp
iswdigit
wcstol
wcsncpy
_ultoa
wcschr
wcslen
_snwprintf
_wcslwr
wcscat
wcscpy
msvcrt
free
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wcsdup
fflush
_iob
fprintf
malloc
_wsetlocale
setlocale
printf
wprintf
vfwprintf
vswprintf
fwprintf
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE