c:\constructicon\builds\gfx\six\21.50\apps\cn\cn\Source\Utilities\CPUMetricsServer\x64\Release\CPUMetricsServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
960eaa1a164198e7b8a951cddc9cff449b5fc1c6906de5263471ec9c31bb4fa9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
960eaa1a164198e7b8a951cddc9cff449b5fc1c6906de5263471ec9c31bb4fa9.exe
Resource
win10v2004-20240226-en
General
-
Target
16019106235.zip
-
Size
160KB
-
MD5
65e145b6cf9334e0b1113a8e02b247dd
-
SHA1
8231e2fa0670f6e113ee2fde2135594e090dc2ca
-
SHA256
d30a7e8591d8f9a3b82563a207eaeaef0b02d9b70bad90a15f7c6a46b25b32fa
-
SHA512
aa505155bf445b871c6edb70212dbb88e85c4394dc8bdacee4449af82813de928342537ff2b7a24dbdfb3c6c20ddca46b2f14a9711d534d62fddde34f5771074
-
SSDEEP
3072:3I/DgsX5OqY+Ug679/e+cORP7XUz1h0L3O7WXOgl/mMwvY5U:4/sGOqRM79/eyXUZeL3Ou4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/960eaa1a164198e7b8a951cddc9cff449b5fc1c6906de5263471ec9c31bb4fa9
Files
-
16019106235.zip.zip
Password: infected
-
960eaa1a164198e7b8a951cddc9cff449b5fc1c6906de5263471ec9c31bb4fa9.exe windows:6 windows x64 arch:x64
0176b357e5111eb744e5dc6c361a73ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateFileMappingW
MapViewOfFile
CreateFileW
GetSystemDirectoryW
GetLastError
WriteConsoleW
ResetEvent
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
CloseHandle
SetEvent
CreateEventW
UnmapViewOfFile
OpenFileMappingW
ReleaseMutex
OpenEventW
WaitForSingleObject
CreateMutexW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileType
LCMapStringW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
MultiByteToWideChar
LocalFree
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
HeapAlloc
HeapFree
ExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
DecodePointer
user32
GetMessageW
DefWindowProcW
CreateWindowExW
RegisterClassExW
DispatchMessageW
SetPropW
TranslateMessage
LoadIconW
ChangeWindowMessageFilterEx
advapi32
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ControlService
StartServiceW
ChangeServiceConfigW
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoUninitialize
oleaut32
VariantClear
SysAllocString
SysFreeString
platform
GetRmCpuParameters
IsVBSCheckRequired
SetEDCVDDLimit
SetTDCSOCLimit
GetCurrentFMaxGPU
SetTDCVDDLimit
SetPPTLimit
SetAutoOverClockGPU
EnableDisablePBOScalar
GetCapabilities
SetAutoOverClockCPU
SetEDCSOCLimit
IsSupportedProcessor
GetCurrentFMaxCPU
Sections
.text Size: 205KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ