A:\FFFFFFFFFss.pdb
Static task
static1
Behavioral task
behavioral1
Sample
206210538bc53217bc114bea78c5a0f5782d0fd885fb57f0a2ee5afb0fc60d71.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
206210538bc53217bc114bea78c5a0f5782d0fd885fb57f0a2ee5afb0fc60d71.exe
Resource
win10v2004-20240419-en
General
-
Target
206210538bc53217bc114bea78c5a0f5782d0fd885fb57f0a2ee5afb0fc60d71
-
Size
348KB
-
MD5
07588f30746c562c8df740184a5562eb
-
SHA1
3e0913cb35a6dc567a342dcafbfd7e21abf3a321
-
SHA256
206210538bc53217bc114bea78c5a0f5782d0fd885fb57f0a2ee5afb0fc60d71
-
SHA512
803884fc7b57e0fed50f20797e58d0894ba6102f03b0429e39026370fccf056c0d70c0fa5f6fa0c9372425526809ef98cb30e95540d14c644b6e606421ab9842
-
SSDEEP
6144:amLvgrTuPTEkdOJRxwmMFL5gO2hdrCQ/D1+OpGD+sfYKT:TD5wuOzxw/FFF2hcaDVpGK+T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 206210538bc53217bc114bea78c5a0f5782d0fd885fb57f0a2ee5afb0fc60d71
Files
-
206210538bc53217bc114bea78c5a0f5782d0fd885fb57f0a2ee5afb0fc60d71.exe windows:4 windows x86 arch:x86
2376a3f0ae02846914825d5a57784fe0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedExchange
GetTickCount
FindFirstChangeNotificationW
SetLocaleInfoA
CancelWaitableTimer
FreeEnvironmentStringsA
GetSystemPowerStatus
GetTimeFormatW
GetModuleFileNameA
GetComputerNameExW
QueueUserWorkItem
lstrlenW
GetSystemDefaultLangID
FindNextVolumeMountPointA
GetFileSize
GetProcessAffinityMask
GetSystemDirectoryA
EnumSystemLanguageGroupsW
GetLongPathNameA
HeapCompact
IsBadCodePtr
GetProfileStringW
OpenWaitableTimerW
WinExec
ResumeThread
CreateTimerQueue
GlobalLock
GlobalSize
QueryDosDeviceA
GetPriorityClass
VirtualFreeEx
GlobalGetAtomNameW
RegisterWaitForSingleObject
GetProcessVersion
SetCommConfig
DeleteTimerQueueTimer
ExpandEnvironmentStringsA
FreeLibrary
SetMessageWaitingIndicator
FlushConsoleInputBuffer
SetPriorityClass
GetCalendarInfoW
SetCalendarInfoA
SetHandleCount
SetProcessWorkingSetSize
MapViewOfFileEx
lstrcatA
user32
GetWindowLongA
GetTitleBarInfo
BroadcastSystemMessageW
CallNextHookEx
IsMenu
GetMenuStringA
SendMessageCallbackA
ScrollDC
CharUpperBuffA
SetMenuItemInfoW
CreateWindowExA
rpcrt4
RpcAsyncGetCallStatus
RpcEpRegisterW
RpcSmEnableAllocate
RpcBindingInqAuthInfoExA
NdrVaryingArrayBufferSize
NDRCContextBinding
NdrXmitOrRepAsFree
RpcStringBindingComposeW
NdrUserMarshalFree
RpcBindingSetAuthInfoExW
UuidToStringA
I_RpcServerUseProtseqEp2A
NdrSendReceive
RpcServerUnregisterIf
NdrEncapsulatedUnionBufferSize
I_RpcClearMutex
RpcSsDisableAllocate
RpcNsBindingInqEntryNameW
NDRSContextUnmarshallEx
NdrConformantVaryingArrayUnmarshall
pdh
PdhFormatFromRawValue
PdhEnumObjectsW
PdhEnumMachinesA
PdhUpdateLogFileCatalog
PdhGetFormattedCounterValue
PdhLookupPerfIndexByNameA
PdhGetDllVersion
PdhValidatePathW
PdhCloseLog
PdhEnumObjectsA
PdhGetDefaultPerfObjectA
PdhUpdateLogA
PdhRemoveCounter
PdhSetQueryTimeRange
PdhMakeCounterPathA
PdhExpandCounterPathW
PdhGetDefaultPerfCounterA
PdhSelectDataSourceA
PdhEnumObjectItemsW
PdhUpdateLogW
PdhParseInstanceNameA
PdhParseInstanceNameW
PdhGetDataSourceTimeRangeA
Sections
.text Size: 260KB - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ