C:\Users\pc\Desktop\Cpp Grabber\Rw\x64\Release\Rw.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Rw.exe
Resource
win11-20240508-en
General
-
Target
Rw.exe
-
Size
15KB
-
MD5
7670bfd6f856a9e9fe306aa126ce3f3f
-
SHA1
d0d32aad57f1080cbb6137b8811012e4eb73adfb
-
SHA256
64c84800e97a75132164e2fb79d15ce7a5f71128afd90f55a728fd2a5c67243b
-
SHA512
eadfafe2236d94fed5adf834e93551693f78a6db2e308f7744375e5a6836a43efff03e3c2d7d81abe42f4b720b32d085e1a0c3304b46f7c4c48b45201f951ed6
-
SSDEEP
192:YkwddrlTXtDQe5paB2ZuPqfSN5eUbyJaLQDHtnL2Gd11YZ8v/3Q5tfFcttbi:i5TXme5pNuSanb6HtLXnEW3Jb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Rw.exe
Files
-
Rw.exe.exe windows:6 windows x64 arch:x64
336c4c4a5436327d6f322c5ec5159671
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shlwapi
PathStripPathA
kernel32
RtlLookupFunctionEntry
GetModuleFileNameA
FindFirstFileA
GetDriveTypeA
FindNextFileA
FindClose
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetModuleHandleW
RtlCaptureContext
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
vcruntime140
__C_specific_handler
strrchr
__current_exception
__current_exception_context
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
fread
__p__commode
ftell
__stdio_common_vsprintf
fwrite
rewind
fopen
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
fseek
fclose
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
__p___argc
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_initialize_onexit_table
_exit
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ