C:\Users\john\Desktop\Kite_20171025\Release\Kite3(有自启动).pdb
Static task
static1
Behavioral task
behavioral1
Sample
e4c672007f9f6910ff7416a4cc4a25925bd641cb0f60bccb03762f9bcf67591d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e4c672007f9f6910ff7416a4cc4a25925bd641cb0f60bccb03762f9bcf67591d.exe
Resource
win10v2004-20240226-en
General
-
Target
e4c672007f9f6910ff7416a4cc4a25925bd641cb0f60bccb03762f9bcf67591d
-
Size
80KB
-
MD5
36536f8c42c258dcc23889de6d72019e
-
SHA1
44673e28e03d642e937eb5d6fed9fc6535e4b872
-
SHA256
e4c672007f9f6910ff7416a4cc4a25925bd641cb0f60bccb03762f9bcf67591d
-
SHA512
0622f417d698b0a0ec1b56553a924d74609dd157f634ccea390eef25e8d8deefce78e393f516cd7cc59d4c516e0144fcb4960740a0bec35d28386030a6cd5786
-
SSDEEP
1536:wParBAcpGmgGO9FR6p+4922Ap8bfSpFskn6JIC57DPybf:weBAvbh8p+49r8J6JIC57zybf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e4c672007f9f6910ff7416a4cc4a25925bd641cb0f60bccb03762f9bcf67591d
Files
-
e4c672007f9f6910ff7416a4cc4a25925bd641cb0f60bccb03762f9bcf67591d.exe windows:5 windows x86 arch:x86
09216f24a9b5f3af1a8a8421aacb9f24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ReadFile
MultiByteToWideChar
GetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
GetModuleFileNameA
CloseHandle
DeleteFileA
CreateFileW
GetStringTypeW
LCMapStringW
WriteConsoleW
HeapSize
Sleep
SetStdHandle
HeapReAlloc
LoadLibraryW
WriteFile
ExpandEnvironmentStringsA
GetTickCount
WaitForSingleObject
GetCurrentProcess
SetFilePointer
GetFileSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
FlushFileBuffers
CreateFileA
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetHandleCount
GetFileType
DeleteCriticalSection
RaiseException
user32
SetClipboardViewer
LoadCursorA
UpdateWindow
DispatchMessageA
ShowWindow
LoadAcceleratorsA
SendMessageTimeoutA
DefWindowProcA
ChangeClipboardChain
TranslateAcceleratorA
CreateWindowExA
DestroyWindow
GetMessageA
RegisterClassExA
PostQuitMessage
LoadStringA
SendMessageA
TranslateMessage
advapi32
RegCloseKey
RegOpenKeyA
RegSetValueExA
ole32
CoCreateGuid
winhttp
WinHttpCloseHandle
WinHttpReadData
WinHttpReceiveResponse
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
iphlpapi
GetAdaptersInfo
Sections
.text Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ