C:\yavu_yonifexusad-liyivi52.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9ee1a587acaddb45481aebd5778a6c293fe94f70fe89b4961098eb7ba32624a8.exe
Resource
win7-20240221-en
General
-
Target
9ee1a587acaddb45481aebd5778a6c293fe94f70fe89b4961098eb7ba32624a8
-
Size
726KB
-
MD5
dfff334622bccba782126e953bcf1fae
-
SHA1
cac977827bc96e7ee2a9291f315f0da4e4eedb70
-
SHA256
9ee1a587acaddb45481aebd5778a6c293fe94f70fe89b4961098eb7ba32624a8
-
SHA512
e0925b4d63b2e06d10dfbce01f5385fa4c21fe91e46b78f4a8580215d9f7eabed8ce1b46161453e9616d9f174ba588e4809a7efa61ba7b013d380a3c6104a82d
-
SSDEEP
12288:6cKxIkW2IwfCmlIrRKEiSYbjnCc0p9HAuh8x9RGx8BocEJqJ3vt54iGpbL:9J2hfTIIxSYPb0HAsGZEJUvt54iKL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9ee1a587acaddb45481aebd5778a6c293fe94f70fe89b4961098eb7ba32624a8
Files
-
9ee1a587acaddb45481aebd5778a6c293fe94f70fe89b4961098eb7ba32624a8.exe windows:5 windows x86 arch:x86
206da623473d02b865ed54c000795f42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExitProcess
GetCommandLineW
GetTempFileNameW
GetPrivateProfileSectionNamesW
GlobalFix
SearchPathW
SetFilePointer
CopyFileExW
SetLocalTime
GetDriveTypeW
DebugActiveProcessStop
BuildCommDCBAndTimeoutsA
CallNamedPipeA
SystemTimeToTzSpecificLocalTime
DeleteVolumeMountPointA
SetUnhandledExceptionFilter
ScrollConsoleScreenBufferW
SetConsoleActiveScreenBuffer
SetHandleInformation
GetProfileStringW
GetProfileSectionA
WaitForSingleObject
SetComputerNameW
AddConsoleAliasW
FlushConsoleInputBuffer
OpenSemaphoreA
SetTapeParameters
GetProcessPriorityBoost
GetModuleHandleW
CreateNamedPipeW
IsBadReadPtr
EnumTimeFormatsW
TlsSetValue
LoadLibraryW
SizeofResource
LeaveCriticalSection
GlobalFlags
HeapCreate
SetConsoleMode
GetFileAttributesW
GetBinaryTypeA
SetSystemPowerState
GetTimeZoneInformation
GetConsoleFontSize
GetOverlappedResult
lstrlenW
DisconnectNamedPipe
DeactivateActCtx
CreateJobObjectA
FreeLibraryAndExitThread
OpenMutexW
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
VirtualAlloc
SetVolumeLabelW
LocalLock
MoveFileW
CopyFileA
GetConsoleDisplayMode
SetComputerNameA
OpenWaitableTimerA
OpenThread
WriteConsoleA
LocalAlloc
SetConsoleOutputCP
SetFileApisToANSI
SetCommMask
GetPrivateProfileStructA
SetSystemTime
GetOEMCP
WriteProfileStringA
RequestWakeupLatency
GetConsoleCursorInfo
GetVolumeInformationW
lstrcpyA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
WideCharToMultiByte
MoveFileA
GetStartupInfoW
HeapValidate
RaiseException
UnhandledExceptionFilter
RtlUnwind
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetACP
GetCPInfo
IsValidCodePage
TlsGetValue
TlsAlloc
GetCurrentThreadId
TlsFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapFree
VirtualFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetStdHandle
GetConsoleOutputCP
CloseHandle
CreateFileA
user32
GetCursorInfo
Exports
Exports
_getArchiveInfo@8
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 508KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ