D:\SicentCI\jenkins-slave\workspace\advflow2\xIcon\Bin\Release\ShellExe\ShellExe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9b3def7454bfa3e997348afbdbe8acc164ec3232e4b96f31b8528ae87ac4609b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9b3def7454bfa3e997348afbdbe8acc164ec3232e4b96f31b8528ae87ac4609b.exe
Resource
win10v2004-20240226-en
General
-
Target
9b3def7454bfa3e997348afbdbe8acc164ec3232e4b96f31b8528ae87ac4609b
-
Size
806KB
-
MD5
012484b16a46a35010bcef2c9d4cdf5f
-
SHA1
9fcd8c7f0a62a772880f73c45e377cef9dd0a2fa
-
SHA256
9b3def7454bfa3e997348afbdbe8acc164ec3232e4b96f31b8528ae87ac4609b
-
SHA512
e07bc7acb8ee1567309f8a64257b7c47716af16a3ed3025770486b01a945909e7d2c501b79478b89f2ecabd0f7ce1d760ab8a8cc1dda82fb02dcd25dd4ae154f
-
SSDEEP
12288:EIJf7dcTDvOMf7TgzVddzdhxFE6nBuWsrv2GMgbEIcOuw/vRd4SVXXxNDhaUs2bE:EIJfvMfaZFECIcOlnpvDzs2bsT7F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b3def7454bfa3e997348afbdbe8acc164ec3232e4b96f31b8528ae87ac4609b
Files
-
9b3def7454bfa3e997348afbdbe8acc164ec3232e4b96f31b8528ae87ac4609b.exe windows:5 windows x86 arch:x86
cd9926343c0184dc34247c7bdaa4fbff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
iphlpapi
GetAdaptersInfo
advapi32
CryptReleaseContext
GetUserNameA
OpenProcessToken
CryptGenRandom
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextA
CryptImportKey
CryptEncrypt
LookupAccountNameA
CryptHashData
ConvertSidToStringSidA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptCreateHash
ws2_32
accept
listen
WSAGetLastError
gethostname
htonl
ntohl
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
recvfrom
connect
getpeername
getsockopt
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
__WSAFDIsSet
WSASetLastError
htons
sendto
socket
closesocket
ioctlsocket
crypt32
CertFreeCertificateContext
wldap32
ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord22
ord211
ord143
ord60
kernel32
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetModuleFileNameW
GetStartupInfoW
SetHandleCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapCreate
ExitProcess
HeapSize
IsValidCodePage
GetOEMCP
GetACP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
FindFirstFileExA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
ExitThread
HeapReAlloc
LoadLibraryW
SetStdHandle
GetFullPathNameA
GetCurrentDirectoryW
RtlUnwind
RaiseException
HeapSetInformation
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
Sleep
SetCurrentDirectoryA
GetLastError
GetFileSize
CreateDirectoryA
GetModuleFileNameA
GetModuleHandleExA
CloseHandle
SetFilePointer
CreateFileA
SetEndOfFile
SystemTimeToFileTime
WriteConsoleW
FindClose
FindNextFileA
FindFirstFileA
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
WriteFile
FileTimeToSystemTime
OutputDebugStringA
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
EnterCriticalSection
GetTickCount
GetProcAddress
GetModuleHandleA
GetNativeSystemInfo
GetComputerNameExA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
QueryDosDeviceA
GetLogicalDriveStringsA
LocalFree
FormatMessageA
GetCurrentProcess
OpenProcess
HeapFree
GetProcessHeap
WaitForSingleObject
CreateToolhelp32Snapshot
ResumeThread
TerminateProcess
CreateProcessA
ReadFile
Process32Next
Process32First
FreeLibrary
LoadLibraryA
Module32Next
Module32First
GetFileAttributesExA
GetFileAttributesA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
HeapAlloc
CreateFileW
TlsGetValue
TlsSetValue
TlsAlloc
CreateEventA
SetEvent
TerminateThread
CreateThread
GetModuleHandleW
VirtualFree
VirtualAlloc
CreateFileMappingA
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
TlsFree
PostQueuedCompletionStatus
InterlockedExchangeAdd
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
VerSetConditionMask
SetWaitableTimer
CreateIoCompletionPort
QueueUserAPC
WaitForMultipleObjects
GetQueuedCompletionStatus
SetLastError
InterlockedCompareExchange
GetSystemTimeAsFileTime
ReleaseSemaphore
OpenEventA
ResetEvent
SleepEx
GetSystemDirectoryA
PeekNamedPipe
GetFileType
GetStdHandle
GetCommandLineA
DecodePointer
EncodePointer
GetTimeZoneInformation
SetEnvironmentVariableA
GetDriveTypeW
DeleteFileA
DeviceIoControl
user32
FindWindowA
wsprintfA
GetWindowThreadProcessId
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationA
psapi
GetModuleFileNameExA
GetDeviceDriverBaseNameA
EnumDeviceDrivers
GetProcessImageFileNameA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
userenv
ExpandEnvironmentStringsForUserA
Sections
.text Size: 598KB - Virtual size: 598KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ