C:\sanilip\vuviyut30\gujaguhal61-yavafoze\tunolaye\tusud.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c6b0270fa953178cb8fcc480077737c021f788fde37e5199771f595f7e09a73d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6b0270fa953178cb8fcc480077737c021f788fde37e5199771f595f7e09a73d.exe
Resource
win10v2004-20240412-en
General
-
Target
c6b0270fa953178cb8fcc480077737c021f788fde37e5199771f595f7e09a73d
-
Size
310KB
-
MD5
49ec31390672497da1bcf466d4d528dd
-
SHA1
14654b217600fc751eb2b1ac0667af0295440056
-
SHA256
c6b0270fa953178cb8fcc480077737c021f788fde37e5199771f595f7e09a73d
-
SHA512
7293e43745f7998267409ff0bde866ac02378e81381b6f4c76dfd37014abf2375dd231ba2d4b93e4b765049bf39799a9229d781623c4f5be5517335c48ee276a
-
SSDEEP
3072:3pN+c08BuB9bRH9MhtfQ4+2PkBITB4g01z7+oGSF/W+XkhNEm+y83NRN3krUC:6k6bZ9WQ4dmB+oGQ+tzEm+z3NRN3O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c6b0270fa953178cb8fcc480077737c021f788fde37e5199771f595f7e09a73d
Files
-
c6b0270fa953178cb8fcc480077737c021f788fde37e5199771f595f7e09a73d.exe windows:5 windows x86 arch:x86
d494868981cb85796a66f3e2567657de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetSystemDefaultLangID
DebugActiveProcess
SetThreadContext
WriteConsoleInputW
GetCurrentProcess
CreateHardLinkA
GetNumberFormatA
ReadConsoleW
GetCompressedFileSizeW
GetVolumeInformationA
GlobalFindAtomA
LoadLibraryW
TerminateThread
GetLocaleInfoW
ReadConsoleInputA
ReadProcessMemory
GetConsoleAliasExesLengthW
GetFileAttributesA
GetConsoleAliasW
GetModuleFileNameW
GetACP
GetLastError
GetThreadLocale
RemoveDirectoryA
CopyFileA
VirtualAllocEx
GetNumaHighestNodeNumber
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
SetCalendarInfoW
AddAtomW
VirtualLock
GetCommMask
FindFirstVolumeMountPointA
VirtualProtect
GetWindowsDirectoryW
DeleteTimerQueueTimer
FindNextVolumeA
SetEndOfFile
CreateFileW
WriteConsoleW
OutputDebugStringW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapFree
GetCommandLineA
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetCurrentThreadId
IsDebuggerPresent
GetStdHandle
GetFileType
GetProcessHeap
ReadFile
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
CloseHandle
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
SetStdHandle
FlushFileBuffers
user32
GetMenuInfo
winhttp
WinHttpReadData
Sections
.text Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 41.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ