pidgenx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
21c8dd6c720928e7fd9f0ed914a3dfff29b240a1b647ea6929c0b881ca485759.dll
Resource
win7-20240220-en
General
-
Target
21c8dd6c720928e7fd9f0ed914a3dfff29b240a1b647ea6929c0b881ca485759
-
Size
1.6MB
-
MD5
af9c842e1fb7c7c19e2adaaaab745353
-
SHA1
943152839af8595fa94009f28940b371c0f9316e
-
SHA256
21c8dd6c720928e7fd9f0ed914a3dfff29b240a1b647ea6929c0b881ca485759
-
SHA512
0cea1e55abca6ce6577c41d0f15804a15715dfbbf0c90e8f3bf0e76857329ab9336b016265399cd8c6ede8efab80068f853e9e775a382a8a779d5c6f21b2fc17
-
SSDEEP
49152:bbK8Jw9oCKTmlkaTDnokjscqnT+8ZIlwVHkm:buai/Az1ZIlwh/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 21c8dd6c720928e7fd9f0ed914a3dfff29b240a1b647ea6929c0b881ca485759
Files
-
21c8dd6c720928e7fd9f0ed914a3dfff29b240a1b647ea6929c0b881ca485759.dll windows:6 windows x86 arch:x86
d9cce9cac67215391da3d888c5137316
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_onexit
_lock
__dllonexit
_unlock
memmove
memcpy
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsicmp
_purecall
_vsnwprintf
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
wcsstr
wcschr
memset
kernel32
InterlockedExchangeAdd
CreateEventW
CreateSemaphoreW
VirtualQuery
ReleaseSemaphore
SetEvent
WaitForSingleObject
GetModuleFileNameW
GetCurrentThread
GetThreadPriority
GetProcessAffinityMask
RaiseException
UnmapViewOfFile
GetSystemInfo
VirtualProtect
FreeLibrary
LoadLibraryW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibraryAndExitThread
VirtualFree
VirtualAlloc
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
LocalFree
CloseHandle
GetLastError
GetVersionExA
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetLastError
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetVersion
SetThreadPriority
WaitForMultipleObjects
CreateThread
MapViewOfFile
CreateFileMappingW
SystemTimeToFileTime
GetLocalTime
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
advapi32
TraceEvent
CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
CryptGenRandom
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
CryptReleaseContext
rpcrt4
UuidToStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidFromStringW
Exports
Exports
PidGenX
PidGenX2
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 376KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ