C:\guy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe
Resource
win7-20240221-en
General
-
Target
71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35
-
Size
661KB
-
MD5
d9300ff1b9e6c7ef3f1c6cac4c30bb72
-
SHA1
833a8f095aa555f3fa3e873adadc0879a4bcfc5a
-
SHA256
71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35
-
SHA512
820ebc7944f1eaea8ca0733aabf308b2ec6cba57a965c01fbcb697a6a6e9584855d2334bfb4b48339782f791edf6ff1740d01a5bb576c21197677d351cd76325
-
SSDEEP
12288:UMuiU0Jflt9Cyu8kqV2IlrRaCycHRiPTiIKDYOuBikqxK63+JTve2:TTJflCyuIltaCvITKYOu4kD63+x22
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35
Files
-
71e9cc55f159f2cec96de4f15b3c94c2b076f97d5d8cecb60b8857e7a8113a35.exe windows:5 windows x86 arch:x86
7d937a0f3f48b97c351ffddb05cd0a24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteConsoleInputW
lstrlenA
SetLocalTime
GetDefaultCommConfigW
BuildCommDCBAndTimeoutsA
FreeLibrary
LoadResource
SetUnhandledExceptionFilter
LoadLibraryExW
ZombifyActCtx
GlobalSize
CreateJobObjectW
HeapFree
SetHandleInformation
SetComputerNameW
SetVolumeMountPointW
ConnectNamedPipe
CallNamedPipeW
CreateNamedPipeW
VirtualFree
EnumTimeFormatsW
TzSpecificLocalTimeToSystemTime
SetProcessPriorityBoost
TlsSetValue
GetPriorityClass
GlobalAlloc
GetVolumeInformationA
GetSystemPowerStatus
SizeofResource
CreateMutexW
DeleteVolumeMountPointW
LeaveCriticalSection
GetFileAttributesA
SetConsoleMode
SetConsoleCursorPosition
VerifyVersionInfoA
TerminateProcess
ReadFile
GetTimeZoneInformation
GetBinaryTypeW
DeactivateActCtx
GetLastError
GetLocalTime
LoadLibraryA
OpenMutexA
MoveFileA
GetCommMask
GetOEMCP
DebugSetProcessKillOnExit
CreateIoCompletionPort
VirtualProtect
GetCurrentDirectoryA
GetSystemTime
GetConsoleSelectionInfo
GetProfileSectionW
lstrcpyA
GetVersionExW
GetCommandLineW
DeleteFileA
HeapReAlloc
HeapAlloc
GetStartupInfoW
RaiseException
RtlUnwind
EnterCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
IsValidCodePage
MultiByteToWideChar
HeapSize
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
GetModuleHandleA
user32
GetTitleBarInfo
advapi32
SetThreadToken
Exports
Exports
_go@4
_kir@8
Sections
.text Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 510KB - Virtual size: 39.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ