C:\hexuva_cikucoxeveditede\yuyoyinojet91 t.pdb
Static task
static1
Behavioral task
behavioral1
Sample
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Resource
win10v2004-20240226-en
General
-
Target
9ccea57913edfffe3f55c8bf6bf8329d5b1a833b1329bd0656a11ba53347f7f6
-
Size
541KB
-
MD5
145cb17599f245058b5fd7fccb6f0d8a
-
SHA1
4ebfef558949f71b78efd9a874951cac799ecbb3
-
SHA256
9ccea57913edfffe3f55c8bf6bf8329d5b1a833b1329bd0656a11ba53347f7f6
-
SHA512
2e9cca98b7b602a51794bd7e1c8d554d40a1ac2a5c4f4686afd0878dac0df2d732b8cb66b12150b3306dae086847167fa35ac15cefcc859e48464d4e7918404b
-
SSDEEP
12288:oD+XPX/kwky0jq4E50W/sN7sufkFyNI03bUzO4hJcB/77WMa:LP+hMH/GDzNpUK4XCD7WMa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Files
-
9ccea57913edfffe3f55c8bf6bf8329d5b1a833b1329bd0656a11ba53347f7f6.zip
Password: infected
-
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe.exe windows:5 windows x86 arch:x86
ae449b68f65db2bf40f2427fdc3b778e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetTickCount
FindNextVolumeMountPointA
EnumTimeFormatsW
GetUserGeoID
GetProcessTimes
IsBadStringPtrA
SetConsoleTitleA
WritePrivateProfileStringW
GetLastError
GetUserDefaultLCID
GetTapeStatus
LoadLibraryA
OpenWaitableTimerW
LocalAlloc
GetTapeParameters
GlobalAddAtomW
GetTempPathA
OpenFileMappingA
LocalFree
LCMapStringW
GetCurrentProcess
HeapAlloc
DebugActiveProcessStop
lstrlenA
GetProcAddress
SetProcessAffinityMask
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
IsProcessorFeaturePresent
Sleep
HeapSize
GetModuleHandleW
ExitProcess
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
RtlUnwind
GetStringTypeW
SetStdHandle
WriteConsoleW
MultiByteToWideChar
FlushFileBuffers
CreateFileW
CloseHandle
ReadFile
advapi32
SetSecurityDescriptorSacl
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 471KB - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 22.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ