E:\work\endoscope-master\x64\Release\endoscope.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c036b9cbe70edd4b7b85bb7043fc77d78a96f8b7944d36b977811bfb2f925d25.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c036b9cbe70edd4b7b85bb7043fc77d78a96f8b7944d36b977811bfb2f925d25.exe
Resource
win10v2004-20240226-en
General
-
Target
c036b9cbe70edd4b7b85bb7043fc77d78a96f8b7944d36b977811bfb2f925d25
-
Size
2.0MB
-
MD5
ebac88bc4af9763496204c17fd2d9599
-
SHA1
7f99600ceb24077a35cc5ddef978795369904327
-
SHA256
c036b9cbe70edd4b7b85bb7043fc77d78a96f8b7944d36b977811bfb2f925d25
-
SHA512
d1b11c724c02c422c4878987f5c861cb730c4b97529535084621b27ec9ff83a52a3d523810bb5bacb6b943372833cf8b969c698cc7f0d09afaec1eaae6dec6d7
-
SSDEEP
49152:5NybZDNb9EfLtS0eb9lcfYVpqB4lYIVi/+GbiD9AoSaHv83BdXmL:5kD2LtycAvvp2IAP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c036b9cbe70edd4b7b85bb7043fc77d78a96f8b7944d36b977811bfb2f925d25
Files
-
c036b9cbe70edd4b7b85bb7043fc77d78a96f8b7944d36b977811bfb2f925d25.exe windows:6 windows x64 arch:x64
a85ba3b04891b22351e8643da2ea220b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetVersionExW
InterlockedFlushSList
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
shell32
SHGetFolderPathW
dbghelp
SymCleanup
user32
CharUpperBuffW
Exports
Exports
���J�2��a���Α͇�3¥�HY��gW��ֺqe�}�������-�Ba}�O���n��x̑�b"7��������Nﵾ�+a�繈��$)(��{bzq���'��*�s�����[���bLr����O �CXwJ>�a����J|�Bǫ*�c�3��/��v�5�~;m�k�>��+XP{.xТ�_�����~����FP+��P��]5A߇�sG?艹`�\����~��r�|xO���:��w�����������#3IIeZ�W_�Qy�����nU��pԃu�� �=�#���Z{�m���H����y�]vs;���1�zC�9{T�e�!��#�4�)�A���\����7�ҝ`�CŘD/3E}G�L���T��T4m�]���t�x�$���=��A�`U��]+Rz u�0��E|���mm�o�b�X�D�ܕ�rWDq���e\ι��r�>F��֯�Ὰ��4�/_��RK�������2�菧���|���]�o`}��V������ y �g�*wn�v/o�Ӈg�Zf�x�Jg�u�i~�R=ּ�z�i�������yJ���h��5���8jG�A��n�Km>q*�7z��.ŋ�w�x��I����Q���<3]�Y���YY����_U؇�����g���E��@B �sh*V2*�$�.x�K�q��g(A�J?Z� �J��M���#�A�S����0�=6Ѿ����!2b�؛�����&3��0��%��l�~��l&�Lj�G�ȭ?�!�Uw?�PȤ�6� E뱯����2��1k�Z^:����\�O�j��;�4����i�Al#7����a0��=�d �|nm.j\� �%z�B�1�+Y���>jk�(��сr�^a*C�qa>Y����Cv��*���3�,i���0ᾕWĮ�y�`N �celje��\W�����47�+��|��4�;j5 /⟖��p��I�-�)I��p�vb�h�Af!@Ϟ*;����P����;�B!����� �>���=CG����\��i�������LԔ�W�C{zL#����v�dS��y��6��%��!�a����ܒE� ��Em(=��,�4����ф��w�L�,��=��~ֆ`�'�D�s�[�2��^�wI���a"�N�c-ʜcZ����O�\9�s�!1�`������~�]��6o���OL*��e˚{;r�\s�v�ϕEDzX5v�榅!�f�m�`{)�����V�2�kt�`H�(�C��<H[>� �9@����ÇW\f�/�{���Ȭ�3�i�V��L�+* t�IC�����&��`t�=�&�u���2�]���a`�$���&m���VA��+ٞ�Z�z�S���ۥ�M0#ޖP�d0]�Y��0~H�`u��y�����NP��y=b���2&ZE�p�.��^�����&틅��̽ѡ�������h����M��T�Q����C���X7�XG�p���"�<@��q�v��Sy,�\i���|P�:Ah�Hr��n��h ��ε0��T4�rEs$�h�Vy�$e=��$��0 ���^�EW�-�������k�*�6���r}�o�=�\ߵ�x�x���0�����(�>�4mAIǮ$��B����-�B�˾Zy�l�^Z)����M��]y������N�PK�y"sZ{���Y�ǜ�VV�H�rzVa�����`J��:Vo��tT��ԛq�!P���I�2݁�����8t@/9���X&�i���b�����7~�_ӧ�����Z��l��F��7}T�:����2�<�l��C58=�꣏/P�H�pn�/���)�6Ue.L���jEo|]b��U1�9^��x~��$��� �h�k<P���&̆�G6�K��w���osT&Mִ�R���+$�s���֛��;v<7wf]���N�夏6����pN�/�V2�'�OX ��+6|S�S��j<�K�'����ܤ�sl�~���d�3��6y�ƦIc����<��t.F�!�5q4�#u���L��C�l%���6�S<CŅ����B��Hm��+te -������ApS&܌OXK��&s��=�IU+���,��9����ۮ>�� ^ ^g�ԙ�b��������7A���*,ӧ�^� �T�$�*�,�:�}�`���.�/n��&7�O�ڷ��^��t�Q���S�>�����;%�>N�֍)�L�Z%Z��������ƾ>�L���_�l����8=�~I/V.�����{5����Z�9��n7]io"Ʉ�����5� �N���@Zk��?'�.|���TCJӃ|���@��Pg)�4O��2n�o����>)�G��2G�3��:�v�w�v�7���juc�v5��&?�&��M���8|��A���}� �L`��Gw8�`M�Χu)��C��< ����:�k��*�����>���tѡAa>V�0�1Z�D��w�a>7�� ��(#�@k?:��J]�,A��X��u�op֯�9bS�`G܊��x�k����P�����Cm�p������B����a�ޠ�#�c�q�hz�{J$M���|����"đ+�F8��R��dX����v�6�Dq�D�� �_iB&O<r���%=v}�D���\.ѻNo��M�ԀQg� ��;6-��X>\��+��^�B��y�����W��v�s� ��� �@�q�WЦ{kz�O2.���5�#�wViΕ{����[ ��_��x�ު��F�s�F�����vS(�E���>�XP����PG�i���Q�)#��'�]]�Dž�2� �hܥD�5D*�Nz���|���qNQ\5_D�_�vK�������m2�7�60��K:���1O�+��ٲM���H�=:�e��S#�6<͉T�q����Ȥ��L��!=�������x۞��V�����.p�lw&��;Z�I�ahb{�;<^}8=a&���5m �0�|���ɵlm��!0 (��>�g�m�}=@����h�C,z�Ű~��5��t�}���;�bg�Q�����am�F����@z�����F(6���6���.�>�Go+���^\z @�Cz�Im�|�>(�
Sections
.text Size: - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gehcont Size: - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ