e:\Documents and Settings\Zaitsev\Мои документы\Visual Studio Projects\sniffer\Release\sniffer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Malware/sniffer/Release/BuildLog.htm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Malware/sniffer/Release/BuildLog.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Malware/sniffer/Release/sniffer.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Malware/sniffer/Release/sniffer.exe
Resource
win10v2004-20231215-en
General
-
Target
07551e9362d9d25e5a635d786374ea2e5c08afee08e4c1c6f2aa2b3893610731
-
Size
161KB
-
MD5
c5091c8a71f9db9ac4ff351b69e47980
-
SHA1
52a6336a0c1a86c7de7e8a1bb7304a908ad2dbdc
-
SHA256
07551e9362d9d25e5a635d786374ea2e5c08afee08e4c1c6f2aa2b3893610731
-
SHA512
317fa33165980ff97a25fa6fed5e49877ef4faf144b934ef853ef2a75ba57dd00b57029c9ad2cbe1dd4d45ebfc90a0e27e99cc25e72db28578143ddb6d921400
-
SSDEEP
3072:Td/JVIjs0nUKknRmk5DWw5BPKr5j45ZMOVNKx5NPU8pvuI8DdK:lfIj7UBRm2DtBe5jOu4etpmI8DdK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Malware/sniffer/Release/sniffer.exe
Files
-
07551e9362d9d25e5a635d786374ea2e5c08afee08e4c1c6f2aa2b3893610731.rar
-
Malware/FileLock1/FileLock.cfg
-
Malware/FileLock1/FileLock.dof
-
Malware/FileLock1/FileLock.dpr
-
Malware/FileLock1/FileLock.res
-
Malware/FileLock1/Unit1.dcu
-
Malware/FileLock1/Unit1.dfm
-
Malware/FileLock1/Unit1.pas
-
Malware/TrojanDLL1/Unit1.dcu
-
Malware/TrojanDLL1/Unit1.ddp
-
Malware/TrojanDLL1/Unit1.dfm
-
Malware/TrojanDLL1/Unit1.pas
-
Malware/TrojanDLL1/test_td.cfg
-
Malware/TrojanDLL1/test_td.dof
-
Malware/TrojanDLL1/test_td.dpr
-
Malware/TrojanDLL1/test_td.res
-
Malware/TrojanDLL1/test_td_loader.cfg
-
Malware/TrojanDLL1/test_td_loader.dof
-
Malware/TrojanDLL1/test_td_loader.dpr
-
Malware/TrojanDLL1/test_td_loader.res
-
Malware/TrojanDLL2/TrojanDLL2.cfg
-
Malware/TrojanDLL2/TrojanDLL2.dof
-
Malware/TrojanDLL2/TrojanDLL2.dpr
-
Malware/TrojanDLL2/TrojanDLL2.res
-
Malware/TrojanDLL2/Unit1.dcu
-
Malware/TrojanDLL2/Unit1.dfm
-
Malware/TrojanDLL2/Unit1.pas
-
Malware/TrojanDLL2/Unit1.~dfm
-
Malware/TrojanDLL2/Unit1.~pas
-
Malware/sniffer/Release/BuildLog.htm.html
-
Malware/sniffer/Release/sniffer.exe.exe windows:4 windows x86 arch:x86
33913d581dc572f3d4849d6497c05b04
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
WSAStartup
socket
gethostname
gethostbyname
bind
ioctlsocket
recv
kernel32
GetFileType
GetSystemInfo
VirtualProtect
GetLocaleInfoA
CloseHandle
SetStdHandle
GetStringTypeW
GetStringTypeA
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
FlushFileBuffers
SetFilePointer
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
Sections
.text Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Malware/sniffer/Release/sniffer.obj
-
Malware/sniffer/Release/sniffer.pdb
-
Malware/sniffer/Release/stdafx.obj
-
Malware/sniffer/Release/vc70.idb
-
Malware/sniffer/Release/vc70.pdb
-
Malware/sniffer/sniffer.cpp
-
Malware/sniffer/sniffer.sln
-
Malware/sniffer/sniffer.suo
-
Malware/sniffer/sniffer.vcproj.xml
-
Malware/sniffer/stdafx.cpp
-
Malware/sniffer/stdafx.h