C:\Users\mateu\source\repos\Billy\Billy\obj\Debug\Billy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fd371477cec08cf0f69755577fd0e1ab8b8135902d6cf410d7a78a9269e0da96.exe
Resource
win7-20240221-en
General
-
Target
fd371477cec08cf0f69755577fd0e1ab8b8135902d6cf410d7a78a9269e0da96
-
Size
36KB
-
MD5
19ed25f02b4e9b9c3ef60c14d0ad1762
-
SHA1
3ca04ac74f5aad6d342c057735452ff6b2d43758
-
SHA256
fd371477cec08cf0f69755577fd0e1ab8b8135902d6cf410d7a78a9269e0da96
-
SHA512
bf1e331f0ec03b1dc5293447f9928d1ef1afb578f7c64653dc8d2d14aca1239c7c584a57f185ba516061017ac69d1ab66d724605304df75df19fbf187fe9c122
-
SSDEEP
768:WZfOT8sElQbRRegnP2FpOP2OPHH3Xe+PP+eDWiECJ4o1tYcFA/Vc6K:WZf9sEOL5P2FpOP2OPHH3Xe+PP+ebEMX
Malware Config
Signatures
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd371477cec08cf0f69755577fd0e1ab8b8135902d6cf410d7a78a9269e0da96
Files
-
fd371477cec08cf0f69755577fd0e1ab8b8135902d6cf410d7a78a9269e0da96.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ