C:\Users\Administrator\Documents\Work\DemProject\Output\Loader\Release\Loader_Release_Win32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9.exe
Resource
win10v2004-20240412-en
General
-
Target
15516330291.zip
-
Size
120KB
-
MD5
bde8f72a459c0a3fb8c67ae259b58e97
-
SHA1
a79e120280845350c9db1fe0f7544a2ee88a926d
-
SHA256
c87f8f0f57be3ce0fae7e935c05d8a8476a93168c9accdb99f051dd42fe3d623
-
SHA512
6110c0654ae7340fb62766543a26a4adde9b9fcb55a95c8fd3906bdb6e5a9b19204e50b9b723aaf891ba614ff68debcb43d050cf4e5d01970260879022d8ad44
-
SSDEEP
3072:PiqAY1d7gUkCm49KPbtKN0/CQIWcoJxbhSk1qa:ahYzXAb9KKc8Sk1qa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9
Files
-
15516330291.zip.zip
Password: infected
-
d963392aa3f2cfe80e55734fdb2e7db55b99309935031e6c7a034cca62ffd3c9.exe windows:5 windows x86 arch:x86
Password: infected
fd3e67a72fcdc11dae1668a9ef71cd6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
WaitForSingleObject
TerminateThread
CreateDirectoryA
CloseHandle
CreateThread
CreateFileA
GetCurrentProcess
WriteFile
OpenProcess
GetFileAttributesA
CreateProcessA
TerminateProcess
MultiByteToWideChar
SetCurrentDirectoryA
GetLastError
Process32FirstW
IsWow64Process
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
DeleteFileA
SetEndOfFile
CreateFileW
ReadConsoleW
ReadFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
OutputDebugStringW
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
EncodePointer
DecodePointer
GetCommandLineW
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WideCharToMultiByte
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
DeleteCriticalSection
HeapSize
RtlUnwind
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
user32
SendMessageW
DispatchMessageW
DefWindowProcW
CreateWindowExW
LoadStringW
LoadIconW
RegisterClassExW
LoadAcceleratorsW
TranslateMessage
EndPaint
DestroyWindow
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadCursorW
BeginPaint
ws2_32
gethostbyname
closesocket
socket
recv
WSACleanup
htons
WSAStartup
connect
send
Exports
Exports
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ