D:\awengar\ctf\tin2024\Banking1\Bank1\x64\Release\Bank1.pdb
Overview
overview
7Static
static
3gorshochek...tar.gz
windows7-x64
7gorshochek...tar.gz
windows10-2004-x64
7sample.tar
windows7-x64
3sample.tar
windows10-2004-x64
3gorshochek...ek.exe
windows7-x64
1gorshochek...ek.exe
windows10-2004-x64
1gorshochek/server.txt
windows7-x64
1gorshochek/server.txt
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
gorshochek_7bec71c.tar.gz
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
gorshochek_7bec71c.tar.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
sample.tar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
sample.tar
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
gorshochek/gorshochek.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
gorshochek/gorshochek.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
gorshochek/server.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
gorshochek/server.txt
Resource
win10v2004-20240412-en
General
-
Target
gorshochek_7bec71c.tar.gz
-
Size
449KB
-
MD5
7bec71cfc8a2557cf6c7ea2e9d19b590
-
SHA1
a2a1a688a4ff17e9a35c568a3b60c1effb25067b
-
SHA256
439d0f8f8a8ebcd1e7083ba2540e6e51cd0cdee00e36e8e6d5843c24becdde58
-
SHA512
776e18d84466693abf22397fac88bef87109a09581f4581cc8b9beb80335aad75854f9c78eee2999954a63e767e7ae17d69f9c98aafb0ef0e356b23e11f41ef1
-
SSDEEP
12288:l3gpuIKmkjyTPwM1DzF+D7UE4f6EIMcmtae3:l3gphKVjy8MpzoD7cxnc9e3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/gorshochek/gorshochek.exe
Files
-
gorshochek_7bec71c.tar.gz.gz
-
sample.tar
-
gorshochek/gorshochek.exe.exe windows:6 windows x64 arch:x64
91c1c6f64a643a368ffc0cf4ab277334
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
Sleep
vcruntime140
__current_exception_context
memset
__FrameUnwindFilter
memmove
__C_specific_handler
__current_exception
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fopen
fgets
fclose
_set_fmode
__acrt_iob_func
__stdio_common_vsprintf
__p__commode
api-ms-win-crt-runtime-l1-1-0
abort
_register_onexit_function
terminate
_execute_onexit_table
_set_app_type
_seh_filter_exe
_seh_filter_dll
_initialize_onexit_table
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_crt_at_quick_exit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
ws2_32
socket
WSACleanup
closesocket
send
recv
connect
htons
inet_addr
gethostbyname
WSAStartup
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-convert-l1-1-0
strtof
mscoree
_CorExeMain
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 567KB - Virtual size: 566KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
gorshochek/server.txt