C:\liweposakor9-gedik.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c04552d204d451152fb453705111b7d7f96209a526d5c9b6d0ee661c863127a7.exe
Resource
win7-20240221-en
General
-
Target
1e1a3cdeecd4e934b2e86307b1c7443e703cca4554e934d307697137654150cf
-
Size
211KB
-
MD5
469fce6a6f99e9dcc6afb693626ec9bf
-
SHA1
b36fac50874abdb774889f57bf271d4bf8fdc284
-
SHA256
1e1a3cdeecd4e934b2e86307b1c7443e703cca4554e934d307697137654150cf
-
SHA512
e33dd93afee2d069a46b390f353411f941ecbadf603cb05338e5f92d9a402f93e0c61558181841c0a6e03046a30fca36826e2f5eb33e98b61d1a65e8b0a2f62e
-
SSDEEP
6144:QdGJ55KB1V8LlrQrfXgZT6dPaxt5fDY+4ZAL:6YEN8ZQrfQZT6dP4jDY+4ZAL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c04552d204d451152fb453705111b7d7f96209a526d5c9b6d0ee661c863127a7.exe
Files
-
1e1a3cdeecd4e934b2e86307b1c7443e703cca4554e934d307697137654150cf.zip
Password: infected
-
c04552d204d451152fb453705111b7d7f96209a526d5c9b6d0ee661c863127a7.exe.exe windows:5 windows x86 arch:x86
9eb0a62c0f4c14301262e17769fe1602
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetComputerNameW
AddConsoleAliasW
GetComputerNameW
GetFileAttributesExA
GetTickCount
FindNextVolumeMountPointA
GetUserDefaultLangID
AssignProcessToJobObject
GetModuleFileNameW
InterlockedExchange
GetLogicalDriveStringsA
GetLastError
GetProcAddress
VirtualAlloc
LoadLibraryA
CreateJobObjectW
LocalAlloc
MoveFileA
GetNumberFormatW
RemoveDirectoryW
GlobalFindAtomW
EnumResourceTypesW
CreateWaitableTimerW
GetConsoleTitleW
VirtualProtect
DeleteFileW
GetCurrentProcessId
UnregisterWaitEx
GetVolumeInformationW
WriteConsoleA
InterlockedDecrement
CreateFileA
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
Sleep
ExitProcess
GetStartupInfoW
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
HeapFree
WriteFile
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
RaiseException
RtlUnwind
HeapAlloc
HeapReAlloc
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
GetConsoleOutputCP
WriteConsoleW
user32
SetMenu
gdi32
GetCharABCWidthsFloatW
winhttp
WinHttpReadData
Sections
.text Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ