C:\cefubapajez\18 f.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
Resource
win10v2004-20240508-en
General
-
Target
eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f
-
Size
287KB
-
MD5
92f390f3cb3415d5a8a0288a78b28f27
-
SHA1
24112f35a3eb494dd9f3aa0f5f655e64a54c440d
-
SHA256
eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f
-
SHA512
4d97c7b06c7119b37a59513d1049b09ddfc00f8abeec14c5f741e4f50aca92294467fdaafc587e106a6564efe2325858a992e33aa8e137955ba52a8498ff9368
-
SSDEEP
6144:z5rnNHxNOCGBcJ/f4ywZfunnMARf4PZudC4z29ysAlgLdt42:dhHxNPmcJ/f4ynnMAtiKmyNk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f
Files
-
eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe windows:5 windows x86 arch:x86
da969c9b2899100752633683fc4632cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryA
GetComputerNameExW
WriteProfileSectionW
GetNumaHighestNodeNumber
FindFirstVolumeW
SetConsoleCursorInfo
HeapLock
FindFirstChangeNotificationA
WaitForMultipleObjects
GetNamedPipeHandleStateW
FileTimeToDosDateTime
EnumResourceTypesW
EnumResourceNamesW
ExitProcess
TerminateThread
ReleaseActCtx
GetVersionExW
VerifyVersionInfoA
GetConsoleOutputCP
SetEvent
FindNextFileW
GetConsoleAliasesLengthA
GetCompressedFileSizeW
CopyFileExA
BuildCommDCBAndTimeoutsW
ReadConsoleOutputCharacterW
SetDefaultCommConfigA
VerLanguageNameA
_hread
GetCommConfig
WritePrivateProfileStructW
FreeEnvironmentStringsW
CreateTimerQueue
FindVolumeClose
ResetWriteWatch
WriteConsoleInputA
SetWaitableTimer
SetComputerNameExA
FindAtomA
ReleaseSemaphore
LocalUnlock
CallNamedPipeW
VirtualProtect
GlobalAlloc
TlsGetValue
GetCommandLineW
InterlockedDecrement
CopyFileW
AddRefActCtx
OutputDebugStringW
FormatMessageA
GetPriorityClass
WritePrivateProfileStringA
GetUserDefaultLCID
GlobalWire
GetVersionExA
HeapValidate
GetWindowsDirectoryA
GetStartupInfoW
ConnectNamedPipe
GetLastError
GetCalendarInfoA
DebugBreak
SetLastError
GetSystemWow64DirectoryA
GetCPInfoExA
GetSystemWindowsDirectoryA
ContinueDebugEvent
InterlockedIncrement
GetOEMCP
GetConsoleAliasA
EnumResourceNamesA
lstrlenA
LoadLibraryW
WriteConsoleA
DeleteCriticalSection
FileTimeToSystemTime
GetSystemTimeAsFileTime
EnumCalendarInfoExW
SetThreadIdealProcessor
GetConsoleAliasW
GetWindowsDirectoryW
GetProfileStringA
CreateIoCompletionPort
AllocConsole
GetNumaNodeProcessorMask
CreateMailslotW
GetCommState
LocalFileTimeToFileTime
CheckRemoteDebuggerPresent
GetSystemTimeAdjustment
_lread
GetWriteWatch
GetModuleHandleW
WriteConsoleInputW
GetConsoleAliasExesLengthW
GetPrivateProfileStringA
GetProfileStringW
MoveFileW
CreateActCtxA
GetUserDefaultLangID
SetCommMask
GetDevicePowerState
SetFileApisToANSI
OpenWaitableTimerA
OpenFileMappingW
GetProcessHandleCount
SetProcessShutdownParameters
PeekNamedPipe
FillConsoleOutputCharacterA
FindNextVolumeMountPointA
SetThreadPriority
InitAtomTable
AddAtomA
WriteConsoleOutputCharacterW
QueryDosDeviceA
InitializeCriticalSection
GetConsoleAliasExesA
GetBinaryTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeleteFileA
RaiseException
GetCommandLineA
GetStartupInfoA
IsBadReadPtr
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
Sleep
GetModuleFileNameA
WriteFile
GetStdHandle
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
FreeEnvironmentStringsA
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
HeapFree
VirtualFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetCPInfo
IsValidCodePage
RtlUnwind
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointer
CloseHandle
SetStdHandle
CreateFileA
user32
CharToOemBuffW
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 71KB - Virtual size: 719KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ