C:\ximifo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe
Resource
win10-20240404-en
General
-
Target
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37
-
Size
263KB
-
MD5
f572d2cf74a7897bebb459dc08a45411
-
SHA1
9a6bc0b9670cf1e5ea21876c1a71bafdec32017f
-
SHA256
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37
-
SHA512
d75df9d31d36776841854c3708727219380cd8731d0669fd18be634047b7526299bd5e5fa561385e7dce458edee417f08ed779b3a590dc9a71450f6ef3557a33
-
SSDEEP
3072:Y2e/zGhApVVIbW+UHPiXQGDL5mc4IRKU1uhIrueTi21TE7idvqjfyJ+dELqPtPe:OzCbWeQmLomRTVxT4O87dEL4t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37
Files
-
3460da28a0587dedb4be574e4b26f25c807d42816562e2abdf61a34c1ac68b37.exe windows:5 windows x86 arch:x86
dbc480346b6d3d9e89c5339bb11a03d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocaleInfoA
FindResourceExW
LocalCompact
InterlockedDecrement
GetComputerNameW
CreateHardLinkA
BackupSeek
GetTickCount
GetConsoleAliasesA
GetWindowsDirectoryA
EnumTimeFormatsA
GetUserDefaultLangID
SetCommState
LoadLibraryW
ReadConsoleInputA
WriteConsoleW
GetModuleFileNameW
MultiByteToWideChar
GetTempPathW
GlobalMemoryStatus
ChangeTimerQueueTimer
SetLastError
GetThreadLocale
GetProcAddress
SetFileAttributesA
BuildCommDCBW
LoadLibraryA
LocalAlloc
GetExitCodeThread
AddAtomW
RemoveDirectoryW
GlobalFindAtomW
GetOEMCP
LoadLibraryExA
VirtualProtect
SetCalendarInfoA
GetConsoleProcessList
GetVolumeInformationW
GetLastError
GetSystemDefaultLangID
GetStringTypeW
HeapAlloc
EncodePointer
DecodePointer
IsProcessorFeaturePresent
GetCommandLineA
RaiseException
RtlUnwind
IsDebuggerPresent
HeapFree
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetStdHandle
WriteFile
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
HeapSize
GetFileType
GetStartupInfoW
CloseHandle
GetCurrentThreadId
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetCPInfo
OutputDebugStringW
SetStdHandle
SetFilePointerEx
HeapReAlloc
LCMapStringW
CreateFileW
advapi32
DeregisterEventSource
winhttp
WinHttpOpen
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 110KB - Virtual size: 60.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ