C:\casiwecedos zidiposi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe
Resource
win7-20240221-en
General
-
Target
f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99
-
Size
700KB
-
MD5
cf584e69d6832fb7f92af0633e6e5222
-
SHA1
fb652a73f6d6de07d22e13de5a19e9fc6f9814b5
-
SHA256
f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99
-
SHA512
f7d6a3a404e18bc598abc86623a3f16083c26d5b29fe37ddf502cd52bec99d80674ccc06d896472950059db947654dd2c0126b3293d2c504a596eef23cbb64ba
-
SSDEEP
12288:ypl5v4OmcfiIhLibgvPjXzaVDScECKuUytXV1rx/ci13p/6EgEVsa0L:w2OzfiIhLigvrXkSw8SV9xEi139TgEi7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99
Files
-
f24ee966ef2dd31204b900b5c7eb7e367bc18ff92a13422d800c25dbb1de1e99.exe windows:5 windows x86 arch:x86
fad9fd2f25ba79ef0607fcf1eb27b49d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateJobObjectW
GetProcessPriorityBoost
WriteConsoleA
SetDefaultCommConfigW
CreateMutexW
SetStdHandle
InterlockedIncrement
SetSystemTimeAdjustment
FileTimeToSystemTime
GetNamedPipeHandleStateA
CallNamedPipeW
BeginUpdateResourceW
BuildCommDCBAndTimeoutsW
EnterCriticalSection
DebugActiveProcessStop
EnumTimeFormatsW
TlsGetValue
GetACP
ReadFile
DeactivateActCtx
ZombifyActCtx
AddRefActCtx
GetHandleInformation
OpenFile
VerifyVersionInfoW
GetVersionExW
FreeLibrary
LoadLibraryExW
GetComputerNameA
CommConfigDialogA
GetProcAddress
lstrcpyA
LoadLibraryW
GlobalAlloc
SetFilePointer
SetWaitableTimer
SetProcessPriorityBoost
GetCurrentDirectoryW
VirtualFree
GetCommMask
HeapSize
RaiseException
GetBinaryTypeW
LocalSize
SetConsoleMode
GetLargestConsoleWindowSize
ReadConsoleOutputAttribute
OpenMutexA
SetThreadContext
AddAtomW
FindNextVolumeMountPointA
GetSystemTime
GetCommandLineA
SetLocalTime
GetSystemTimeAsFileTime
DisconnectNamedPipe
GetConsoleCursorInfo
TerminateProcess
GetFileAttributesW
GetLastError
lstrlenA
CompareStringW
CompareStringA
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
HeapFree
HeapAlloc
LeaveCriticalSection
GetModuleHandleA
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
FatalAppExitA
VirtualAlloc
HeapReAlloc
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FlushFileBuffers
GetLocaleInfoW
CreateFileA
CloseHandle
GetTimeZoneInformation
SetEnvironmentVariableA
user32
GetComboBoxInfo
Sections
.text Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 499KB - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ