E:\project2\project2\XyclopeZ Exploit\obj\Debug\LaoHax.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cebef1a7c93ac51490714aba61d9a6e4d82bb9c22d77804923da71fd869e3a0a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cebef1a7c93ac51490714aba61d9a6e4d82bb9c22d77804923da71fd869e3a0a.exe
Resource
win10v2004-20240508-en
General
-
Target
cebef1a7c93ac51490714aba61d9a6e4d82bb9c22d77804923da71fd869e3a0a
-
Size
983KB
-
MD5
9f6876c782ea2e7a0abf67dca84da435
-
SHA1
11dc96ea388062bdda87221436dfe4dc64571658
-
SHA256
cebef1a7c93ac51490714aba61d9a6e4d82bb9c22d77804923da71fd869e3a0a
-
SHA512
a073aca4e99591eddd283b4fdf5e59ec43052180b87010f629ed0e966666132faa45a0de8ac175ea65ff5789843f345bc994ba8d32b2c8dc269c7ff1431f8a9e
-
SSDEEP
12288:YRgGlruw8PybxoxXbBvEripAnFaDwszL:BGxMosXbB8rfncZzL
Malware Config
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cebef1a7c93ac51490714aba61d9a6e4d82bb9c22d77804923da71fd869e3a0a
Files
-
cebef1a7c93ac51490714aba61d9a6e4d82bb9c22d77804923da71fd869e3a0a.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 882KB - Virtual size: 882KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ