exe\distrib.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1f0257d2a875373d72dfa740d20a9277c49666ea8404982cf43ee103f6e691f7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f0257d2a875373d72dfa740d20a9277c49666ea8404982cf43ee103f6e691f7.exe
Resource
win10v2004-20240226-en
General
-
Target
1f0257d2a875373d72dfa740d20a9277c49666ea8404982cf43ee103f6e691f7
-
Size
60KB
-
MD5
a688d2838e3fa6f0e6ed6be5e9c4ec14
-
SHA1
f906e045d5c6106a709091af750f9837e06cb99d
-
SHA256
1f0257d2a875373d72dfa740d20a9277c49666ea8404982cf43ee103f6e691f7
-
SHA512
a10a5958a97deec3efc8158ef236b0cc6fc787762f6a7c2cb7aea3374871e4f55b352efdd279cab66fd22e06802c2c14e174eaa3396f4d2a3b96960b16034316
-
SSDEEP
768:mKvqxSFYce2D955TdHNdy1pYhQxXl1H9xllMGCan2DTpej46SLFqgb:mK3FYcjD9PdHNgprl1TnnDqkgb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f0257d2a875373d72dfa740d20a9277c49666ea8404982cf43ee103f6e691f7
Files
-
1f0257d2a875373d72dfa740d20a9277c49666ea8404982cf43ee103f6e691f7.exe windows:4 windows x86 arch:x86
34993ee53fbcacaaa8b37eb18ee07841
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
atl71
ord30
ord31
ord58
ord61
ord23
ord32
ord49
ord20
ord17
ord64
ord22
ord18
imagehlp
SymCleanup
SymSetOptions
SymInitialize
SymGetModuleBase
SymFunctionTableAccess
StackWalk
SymGetSymFromAddr
SymUnDName
SymGetModuleInfo
sqlunirl
_GetUnicodeRedirectionLayer@0
_GetProcAddress_@8
_LoadString@16
_FormatMessage@28
_GetVersionEx@4
kernel32
GetThreadLocale
Sleep
SetErrorMode
QueryPerformanceFrequency
GlobalMemoryStatus
GetVersionExA
GetSystemInfo
WriteFile
lstrlenA
HeapFree
CloseHandle
FlushFileBuffers
GetLocaleInfoA
HeapAlloc
GetProcessHeap
GetCurrentProcess
GetEnvironmentVariableA
SetFilePointer
CreateFileA
GetModuleFileNameA
GetSystemDefaultLCID
GetModuleHandleA
FreeLibrary
lstrcpyA
ExpandEnvironmentStringsA
LoadLibraryA
GetACP
GetLastError
GetSystemDefaultLangID
MultiByteToWideChar
WideCharToMultiByte
ResetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
InterlockedIncrement
GetStdHandle
InterlockedDecrement
WaitForSingleObject
WaitForMultipleObjects
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
AllocConsole
GetCurrentThreadId
CreateEventA
GetCommandLineA
RaiseException
InterlockedExchange
FormatMessageA
ExitProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
ReadProcessMemory
user32
MessageBoxA
wsprintfA
advapi32
DeregisterEventSource
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetTokenInformation
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
IsValidSid
GetLengthSid
CopySid
RegSetValueExA
RegisterEventSourceA
ReportEventA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
ole32
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx
oleaut32
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
msvcp71
?_Nomemory@std@@YAXXZ
msvcr71
_cexit
_XcptFilter
_exit
_c_exit
_callnewh
memset
_controlfp
exit
__dllonexit
__security_error_handler
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_resetstkoflw
_iob
freopen
printf
fclose
_onexit
wcschr
wprintf
_except_handler3
free
??3@YAXPAX@Z
??_V@YAXPAX@Z
sprintf
strchr
asctime
localtime
time
_strnicmp
_stricmp
wcsncat
wcslen
wcscpy
wcsncpy
_purecall
malloc
__p___initenv
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ