D:\守护进程-同步物联网卡\trunk\TopProcessDefend\obj\Release\TopProcessDefend.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c9494db3ad78c665990c53774c126af1d83d76984cd4eca752fefb038d17821d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c9494db3ad78c665990c53774c126af1d83d76984cd4eca752fefb038d17821d.exe
Resource
win10v2004-20240226-en
General
-
Target
c9494db3ad78c665990c53774c126af1d83d76984cd4eca752fefb038d17821d
-
Size
11KB
-
MD5
0e8316b33ae0d1506149be2c0624d805
-
SHA1
c879afbcb85f3d60c8047bd4a8e6bdd6d15b2d49
-
SHA256
c9494db3ad78c665990c53774c126af1d83d76984cd4eca752fefb038d17821d
-
SHA512
447acc83b7a0da233ad1ce07d1b0a4013e8d7a762c1e307dd908471b60821dde813fcaa552c98da6ece52bcfbaf6a7b083575340625f313aa1c3f3e4073a36d6
-
SSDEEP
192:dNfRgxg4V7Wz2aOT1+12kbKdlOTzMS4yA7Ol7+aJ7m7aHYYcvh:dxR4g4VCSvx+I3YzF4yPlEaHYYcv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9494db3ad78c665990c53774c126af1d83d76984cd4eca752fefb038d17821d
Files
-
c9494db3ad78c665990c53774c126af1d83d76984cd4eca752fefb038d17821d.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ