D:\Work33\服务端文件\gdunConsole\Release\gdunConsole.pdb
Behavioral task
behavioral1
Sample
ff5dd2cddb9c436aaab58206ea2761f14c28ba707f0b8dce88d0a0bb398b6b74.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff5dd2cddb9c436aaab58206ea2761f14c28ba707f0b8dce88d0a0bb398b6b74.exe
Resource
win10v2004-20240226-en
General
-
Target
ff5dd2cddb9c436aaab58206ea2761f14c28ba707f0b8dce88d0a0bb398b6b74
-
Size
4.8MB
-
MD5
eca1e351349bac7077ed2c1b23fc96e3
-
SHA1
22f8feab50387ca269d3eeaff9291c41adfd74d7
-
SHA256
ff5dd2cddb9c436aaab58206ea2761f14c28ba707f0b8dce88d0a0bb398b6b74
-
SHA512
704c91af4f56d45c8467b1b2f99171e6b382f959e7dff3d838b32247588237063f796d40709c3ba6c9334d2fc866f30a69998a63d3580ddea129161fd0f03043
-
SSDEEP
98304:MqC5RGhvFWpu2aYcnAc0Wv+EZ+PTHwPZ2mXUXKz9w2L6qTo3:MjRGDWGYC0WW/PMh2mEXn2L
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff5dd2cddb9c436aaab58206ea2761f14c28ba707f0b8dce88d0a0bb398b6b74
Files
-
ff5dd2cddb9c436aaab58206ea2761f14c28ba707f0b8dce88d0a0bb398b6b74.exe windows:5 windows x86 arch:x86
edb5ead800a434e91eec2ccaad8b06d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersion
GetVersionExA
GetOEMCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
KillTimer
gdi32
OffsetWindowOrgEx
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveFileSpecW
oledlg
ord8
ole32
RegisterDragDrop
oleaut32
SystemTimeToVariantTime
gdiplus
GdipAlloc
ws2_32
inet_addr
winhttp
WinHttpCloseHandle
wininet
InternetWriteFile
imm32
ImmGetContext
winmm
PlaySoundA
Exports
Exports
??0md5@@QAE@XZ
??4md5@@QAEAAV0@ABV0@@Z
?Decode@md5@@AAEXPAIPAEI@Z
?Digest@md5@@QAEPAEXZ
?Encode@md5@@AAEXPAEPAII@Z
?F@md5@@AAEIIII@Z
?FF@md5@@AAEXAAIIIIIII@Z
?Finalize@md5@@QAEXXZ
?G@md5@@AAEIIII@Z
?GG@md5@@AAEXAAIIIIIII@Z
?H@md5@@AAEIIII@Z
?HH@md5@@AAEXAAIIIIIII@Z
?I@md5@@AAEIIII@Z
?II@md5@@AAEXAAIIIIIII@Z
?Transform@md5@@AAEXPAE@Z
?Update@md5@@QAEXPAEI@Z
?md5Init@md5@@QAEXXZ
?rotate_left@md5@@AAEIII@Z
SW��hk.QH�)���&ፙ�T���h.pm~- Е���>���"�`Hbyl}���;�L�QR��+J�_OxU²�����Ӑ�~WCh�!�z�5р��H���mK�U�n�)e�~�Բ?�ȜraxH�s�cT���S�=I;n�0��� A�$h��k�Y���RmNq��Sc֢)v����9!���r�P��ô��_���E�/=��TIu���a�^hX0W��яY����{*g ir���;ץ���eM���+.�>�En��x�2m�:�{���4z,��i�D�J^�9Ho퇘��rR�$&E�����B4��X��o"D�����]/�4�7��<�S��Wc��|[����X%�*���w$ԣoFFYb)�A2��ؗWO����^D�����sw��-��̠v�]`��6�YF��]��Ϧj��Eiy�ϚP��T/\���wm'.m����U���}+�'UGn��d:|Ӑ��苰��8T�v��s��B<�jc��掓�G�_L��M�b~�IB{5K6AG���C1����Q��㷽/m�0A��i�����n��)iw�{���K��9(���6j��j$Wh�s��ӫ6��Ad���ߣ��V�7�nLˉ����'�:4���N��X< �smŢ%d,��z���v�9��:>"���Y ف#����Q^���҂.`��Wu���a��}�h�8�|N�K�C��hAf�z��Ā�ɶ�-�"z\U:ϣ,b���Bf}�_vYWJ# ��Y��._�{��a�."(��S`�7ɣѬ����Z� �4����g��&h���(P���-\& �� #�V6�HO* z���c�=���kny����@�[.��w��Ŝ�3��B�oxj9 u)RbuH�ށ�+p�rP�}Lh�Su�`C T��(;1H��=2_�>䐭�z����Z�=���1�����{���}��M�C ��Ԝ�lI��f3@��ѶH`&9k#�b *W�����܀��m� $�Ն��{f�VO���` _|��=8$R���B��t�EFu�M�d��]6L�`�n���e�����+&U��f�"���F���?��u����%�*���Y)J�f�$c��Ī �=����Y�nW�I�����C�]�X� 6�����(q��e3â/!�v�lL�j��c�V�IR�O$�}P�U(�r$x�^�?^��e�����_<(��2f��?X:@�h'3�#Bi�kX�'1�c� �j��� �x��V��ë-�O��Y��Rxu�2]�a) �T�v���0 � �l�e����\9}���@�el�0d�A��N*�W���C��M�?�K�9 *��i�3� �R=��WD�HKCT��q���< ���,��i��C�B�zx�]����S��a#����'C�~ �Ƒ�����xP���,N�����>��k-�����d��v'��Nso��#j.�S��`���4�dEX-��D�����t����lF� 0�Z�~��^}.�ŧ�����\5ex��mY��n'��ן!�t��=���b/b�����B��BLd)�3�h����s5�*2��zPJ�Ɋ�m�[h�>��ݹ/C�fy�a��LzM�vk��7����<Zn����˞�E�w6j��#o���P -0�h�����������ѩ��|ų� �6��p0�����O�p���&�2ۦ�@b����^��V��t��P�\��nO�k��R;�n�oώn���1���>�����J0N��0��0^Ƙ���,�Ą�9����T(/��UA%M�({�Z*N��:�����?M����!\y�4!y���|�&ٛS=M��0�����~�M �N6�I�A�b(¨w�����6�xS�@T�t�_ra��I��l9q�J���~��.�L����"�L\�{� u��Vq���� �!���۴�����uZ�v�V�Bx��X���'g����d{���X _��r�$"��rR�o�v���5Q؉���5~���dF�� >#��֡�Ǿ~�p٣��uE$/�%���;90�$���s� ���q�Y-�T�ik��ݛ�es�5$q�}ϖ���PQ�m! u��g@��Q �����P#�/5G]n�D�IJ�����2��e.�� �ΠAH9��ش�"Bn���.�.f�8�$ek��S�����`��� Nϼ�_�ZDh)Zb��"[�m�ū�2˘T�W�9_��o�5/�1q �2 ��ڂ�w�A��7,�Y �`6LkGY6�����-�� ���19r������lĸ3�_��ڼ���Q���J_] ?���[�f��{#�{iI~*}Vٍh����Ή�0��8"~�rw�b�Č/Id́���4�ņ�+�gQi�z2�����3_�Cn=V}³)2� �� �2�����r�n�S�'7 �V����Zl�^���3 ���c�}��奔��v�o� �)i41C4�����"7�y�����w�"]m'�iNz��YN����j8.���0s��r�ĥ�Q �ʕ���9l�7�mǾ{h�d��T��üNqʻ�BnN�dF+M`����$�|�p�I�2�z��� ���C$A���+.B �'�F��v3>���{�^b����NJ��ԣ^��,�^�a�pϱ�%��f|X��|�� ����Ѯ��ӽ����Nϝ�@�?%ڇ礥X;��7��g��@{+�������aL�@VPi��U[��YM1aa�~��tL�1���L;e�`\=E(�5�@ze,�u��?!����>Ze���o�P�d$��j���e��4��u{�|�>�����mD�j�?8�6��_��f��V��� ���E���k�T���U�+�}T(}��ga���$�d�Q�U�>i�A�;#�8.��9��$�l����f�N�/r���2��t�^�Y#6v��@?5n�*���,v�X�"��чTHɨv�싌�S�P�x]�kqm9�v�p���[��:2����T����˼J���6���Σ���A���;Hp�>*�_:�ݑS�e( !�j��\�0���|�P�8��w�4����3�T�w��K��}��P-�
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 425KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ