D:\Programming\Projects\Work\SwampThing\Release\Win32\SwampThing.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec.exe
Resource
win10v2004-20240226-en
General
-
Target
ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec.exe
-
Size
122KB
-
MD5
af5595472e4afc355f9f7977a580e0ae
-
SHA1
0401ee7f3bc384734bf7e352c4c4bc372840c30d
-
SHA256
ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec
-
SHA512
3bec4e5cfcb99c3a32c85aae0c92dd6240ec5fa5ba527b579d6d79fd9b050ae63e57c84d0f17f9dd65dfc6e4b761771b3eb70cfd56035606144dff780b207bb2
-
SSDEEP
1536:NmsOnJ3Jrpv2iQgOHQ+viM6dngDBl+fCKaI2WRbZGT0zf0Lo2Yj:qZrJ2vgOw+aVdgdcCKaIPRs0zf0LW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec.exe
Files
-
ee2c61216ed691f8bf1f080fb9c7d7cfc6f370e6f5c0d493db523b48e699a2ec.exe.exe windows:5 windows x86 arch:x86
58edb5f4eabbb52e430646a5ed1a1cd1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
?terminate@@YAXXZ
_controlfp
__set_app_type
__p__fmode
__p__commode
__setusermatherr
??2@YAPAXI@Z
_amsg_exit
_initterm
_acmdln
exit
_XcptFilter
_exit
_cexit
__getmainargs
_ismbblead
_errno
kernel32
lstrlenA
lstrcpyA
LockResource
SizeofResource
LoadResource
FindResourceA
WriteFile
SetFileTime
GetFileTime
CreateFileA
CloseHandle
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
OutputDebugStringA
lstrcatA
advapi32
ChangeServiceConfig2A
CreateServiceA
ChangeServiceConfigA
QueryServiceStatus
ControlService
OpenServiceA
OpenSCManagerW
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
StartServiceW
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ