gLoW.pdb
Static task
static1
Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
swift copy.exe
Resource
win10v2004-20240508-en
General
-
Target
8c3b116323c2d8030124239d3e250a57.bin
-
Size
682KB
-
MD5
0736559a9f4bfb7a4a5996ad00b4b030
-
SHA1
df3b5bd0a97082f0b8abc1bcc39b251996960518
-
SHA256
a2d308b699bfb035d03c4e7a4f1daee9cee25c18d41c44bb7ad4843b67228797
-
SHA512
53743090bd29c563465a613dfad0500ebd40cff20bf17db18083c220e95e596c04b7acee7fbaa9841d638631475532b2af0c4c32e67e21bdf3497c3f2bf27f8d
-
SSDEEP
12288:Bujt8iYqhE6rVvzEGIdGL2e7WxF01m+/43KaKzhMJKkfF2TMpE/9dxN:NqKgoGLhCC43KaKVMYkf4T6ElN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/swift copy.exe
Files
-
8c3b116323c2d8030124239d3e250a57.bin.zip
Password: infected
-
cc9e34f62774fb3fa3c49c7fb85fc6ca9c05863f6e899eb3d8094dc43c8483de.rar.rar
Password: infected
-
swift copy.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 732KB - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ