C:\Users\classone\Desktop\src\client\exe_debug\client.pdb
Static task
static1
Behavioral task
behavioral1
Sample
84eb2efa324eba0c2e06c3b84395e9f5e3f28a3c9b86edd1f813807ba39d9acb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
84eb2efa324eba0c2e06c3b84395e9f5e3f28a3c9b86edd1f813807ba39d9acb.exe
Resource
win10v2004-20240226-en
General
-
Target
84eb2efa324eba0c2e06c3b84395e9f5e3f28a3c9b86edd1f813807ba39d9acb
-
Size
473KB
-
MD5
ddc9174f111e8aa445a71b8eeb0ad490
-
SHA1
82c18765ac3a1a2ecf3f258c0912beaf5aedd175
-
SHA256
84eb2efa324eba0c2e06c3b84395e9f5e3f28a3c9b86edd1f813807ba39d9acb
-
SHA512
c4e950107ac520ff756abd3fbc7277b6a9e46dd1ef49fa4bb6033c1aa0242ac9a875c77a34634ed0072464be5a0c83b65090df5364e09413a8c75a67f77cedf3
-
SSDEEP
12288:6H9adNVYK8MqqjkYFjtVXoymZ/bbSWTzFe:tN3qqjYymZ/T/Fe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 84eb2efa324eba0c2e06c3b84395e9f5e3f28a3c9b86edd1f813807ba39d9acb
Files
-
84eb2efa324eba0c2e06c3b84395e9f5e3f28a3c9b86edd1f813807ba39d9acb.exe windows:5 windows x86 arch:x86
230ee7132ee82300ed5b4b2c5ba231f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstFileW
CloseHandle
SetFileTime
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetFileSize
CreateFileW
WriteFile
ReadFile
GetFileTime
lstrlenW
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventW
WaitForMultipleObjectsEx
WaitForSingleObject
CancelIo
SetEvent
Sleep
GetSystemDefaultLCID
GetVersionExW
IsWow64Process
GetCurrentProcess
GetComputerNameW
CreateThread
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
TerminateThread
LocalFree
LocalAlloc
PeekNamedPipe
WaitForMultipleObjects
GetOEMCP
GetProcAddress
GetModuleHandleA
CreateEventA
GetLastError
InterlockedDecrement
PostQueuedCompletionStatus
GetSystemInfo
CreateIoCompletionPort
GetQueuedCompletionStatus
GetSystemTimeAsFileTime
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
FindClose
FindNextFileW
QueryDosDeviceW
lstrcmpiW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetTickCount
FindResourceA
LoadResource
LockResource
SizeofResource
FreeResource
GetStringTypeW
GetConsoleMode
GetConsoleCP
HeapQueryInformation
HeapSize
HeapReAlloc
SetStdHandle
HeapDestroy
HeapCreate
GetStartupInfoW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetCurrentProcessId
QueryPerformanceCounter
IsValidCodePage
GetCPInfo
GetACP
LCMapStringW
OutputDebugStringW
GetLocaleInfoW
SetConsoleCtrlHandler
FatalAppExitA
InitializeCriticalSectionAndSpinCount
FreeLibrary
VirtualQuery
GetProcessHeap
HeapAlloc
HeapFree
IsProcessorFeaturePresent
IsBadReadPtr
HeapValidate
ExitProcess
GetCurrentThread
InterlockedIncrement
OutputDebugStringA
InterlockedExchange
RtlUnwind
EncodePointer
DecodePointer
IsDebuggerPresent
RaiseException
LoadLibraryW
GetModuleFileNameW
WriteConsoleW
GetFileType
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
HeapSetInformation
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
GetModuleHandleW
SetLastError
user32
MessageBoxA
wsprintfW
wsprintfA
advapi32
RegDeleteValueW
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
GetUserNameW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
ole32
CoCreateGuid
ws2_32
getaddrinfo
htonl
gethostname
sendto
inet_addr
recvfrom
WSAGetOverlappedResult
WSARecv
WSASend
shutdown
getsockname
getpeername
__WSAFDIsSet
ntohs
connect
select
accept
htons
bind
listen
setsockopt
WSAIoctl
WSACleanup
WSAStartup
closesocket
socket
ioctlsocket
gethostbyname
send
getsockopt
inet_ntoa
WSAGetLastError
iphlpapi
GetAdaptersInfo
Sections
.text Size: 374KB - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 596B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ