C:\Users\admin\Desktop\NZT\ProjectS\x64\Release\SU.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fdc786ed44b1e2f9f4f58087fc0b0a442d8e3901c98c555eea833a9f1fb4f6a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fdc786ed44b1e2f9f4f58087fc0b0a442d8e3901c98c555eea833a9f1fb4f6a0.exe
Resource
win10v2004-20240419-en
General
-
Target
fdc786ed44b1e2f9f4f58087fc0b0a442d8e3901c98c555eea833a9f1fb4f6a0.exe
-
Size
339KB
-
MD5
b5e4c8d1e9a72e8e5977ee0c2055dc77
-
SHA1
0abf8fe2f1df75dcf6be932c6ca1b7cb2e703a00
-
SHA256
fdc786ed44b1e2f9f4f58087fc0b0a442d8e3901c98c555eea833a9f1fb4f6a0
-
SHA512
35c2633b7b31c0ee2154dbe77e71e9498c066bf61cdb89c27242fb431cfa30bbd365c650936508f3eff502d61e03208ee74315b5a6da61c75a0f87c467f39209
-
SSDEEP
3072:GVNDB9iQDSYdSy1DowAlNF4A8v2nPLQ6iagZ6arAMZZ+h9ldiu2zgWjgqXsVQLfY:GV9iMR1DowkNF4A8v2PUn2aMMZZQ/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdc786ed44b1e2f9f4f58087fc0b0a442d8e3901c98c555eea833a9f1fb4f6a0.exe
Files
-
fdc786ed44b1e2f9f4f58087fc0b0a442d8e3901c98c555eea833a9f1fb4f6a0.exe.exe windows:6 windows x64 arch:x64
bcf378c754e3696df706ce0246047a11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
user32
BeginPaint
DialogBoxParamW
PostQuitMessage
LoadCursorW
LoadIconW
DefWindowProcW
DestroyWindow
CreateWindowExW
EndDialog
RegisterClassExW
LoadStringW
EndPaint
advapi32
GetUserNameA
winhttp
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpReceiveResponse
WinHttpReadData
WinHttpSendRequest
crypt32
CryptBinaryToStringA
kernel32
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
HeapSize
FindClose
CreateFileW
WriteConsoleW
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
FindFirstFileExW
InitializeSListHead
ReadFile
SetHandleInformation
CreatePipe
GetLastError
CloseHandle
CreateProcessA
GetComputerNameA
Sleep
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlUnwind
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetUserDefaultLCID
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
Sections
.text Size: 163KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ