C:\Users\steve\source\repos\movemouse\4x\Move Mouse\obj\Debug\Move Mouse.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c0ab471008a11a0ad87284338e8227e379fc866131f1855f233f5e4919a99952.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c0ab471008a11a0ad87284338e8227e379fc866131f1855f233f5e4919a99952.exe
Resource
win10v2004-20240426-en
General
-
Target
c0ab471008a11a0ad87284338e8227e379fc866131f1855f233f5e4919a99952.exe
-
Size
2.3MB
-
MD5
5e8b2209cb045cb86442ea395d3d83e6
-
SHA1
b8156aa934fed6f62847ec2c2ddc4109ad7a07a0
-
SHA256
c0ab471008a11a0ad87284338e8227e379fc866131f1855f233f5e4919a99952
-
SHA512
bcabebe98b0b5b8ba880f857eefe28bb281003a23626cfa974f0d486e9b4aca821776ee1f8e446303fb543cb29f5237384c300db6adfd956bfab2fb8e3fc741c
-
SSDEEP
49152:AwLMWLWc7wH2Cj5tzfk7/QUSSWrYanZdZDPyFhoxhnXqhZqezoQ:zLMU4265tzc7/BSSoYWBDEhAJqhtzo
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0ab471008a11a0ad87284338e8227e379fc866131f1855f233f5e4919a99952.exe
Files
-
c0ab471008a11a0ad87284338e8227e379fc866131f1855f233f5e4919a99952.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ