C:\Users\Administrator\Desktop\rust-earlybird\target\debug\deps\bird.pdb
Static task
static1
Behavioral task
behavioral1
Sample
新-兰州气象局2024气象预警平台初步设计方案资料docx.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
新-兰州气象局2024气象预警平台初步设计方案资料docx.exe
Resource
win10v2004-20240226-en
General
-
Target
新-兰州气象局2024气象预警平台初步设计方案资料docx.exe.vir
-
Size
544KB
-
MD5
43ca4cbd384bd3a1de962d2e7920339a
-
SHA1
0926f05deb42e56aec025b5595fe480fae00e0d8
-
SHA256
133e0afdbc112b910ba7e920a9b1d77630842fc88c4c04cd509b8dd5f6813587
-
SHA512
5737fa34cc94468ce1528ae45f55e7d4a588683bebfde756ca705ed2944bdd6a792717062a8620691e34de62cf0e360d043886e4d691293c93d438739582edf9
-
SSDEEP
12288:qac+x+Kxi3RKpqgS555555555555555SM+AGxqaERacinnwTC:qrqhx2RKpqgS555555555555555SM+Ao
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 新-兰州气象局2024气象预警平台初步设计方案资料docx.exe.vir
Files
-
新-兰州气象局2024气象预警平台初步设计方案资料docx.exe.vir.exe windows:6 windows x64 arch:x64
821342fcc4decc25b36262d4badf59ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateProcessA
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
QueueUserAPC
ResumeThread
CloseHandle
OpenProcess
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentProcess
SetHandleInformation
TryAcquireSRWLockExclusive
GetLastError
GetModuleHandleA
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetStdHandle
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
GetConsoleMode
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
GetCurrentThread
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent
psapi
GetProcessImageFileNameW
EnumProcesses
user32
MessageBoxW
ntdll
RtlNtStatusToDosError
NtWriteFile
ws2_32
connect
WSASocketW
recv
getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
closesocket
send
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memmove
memset
__CxxFrameHandler3
memcpy
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_exe
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
_exit
_set_app_type
terminate
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 279KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 167KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ