C:\Users\pc\Desktop\Cpp Grabber\Rw\x64\Release\Rw.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Rw.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Rw.exe
Resource
win11-20240508-en
General
-
Target
Rw.exe
-
Size
15KB
-
MD5
a8fc77a79bee1a46df7877dbb26e7bfc
-
SHA1
9edd8273ed7a41dbbd370909d21451a7c04397cc
-
SHA256
4e70a312742037656555da58a613e63e669d121c24146bc56c50d48256382730
-
SHA512
0000d164cfe09732625b1ac6a9240909c247bb333eda0dab1b7ca00ee769762103a1aef3fdd4c4f9cdcf414b004de86332845bd10c26b3384ee598f3c99acfcd
-
SSDEEP
192:8lo6RtfNwXdXa1uZuwkpfS0JezxN4a6LQDH98uckd1hKav/3Q5tfFcCbi:uzf6Xh9u3l4DRH983WOs3cb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Rw.exe
Files
-
Rw.exe.exe windows:6 windows x64 arch:x64
749d317e0d8d6a1635df32600c88d211
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shlwapi
PathStripPathA
kernel32
GetModuleHandleW
RtlLookupFunctionEntry
GetModuleFileNameA
FindFirstFileA
GetDriveTypeA
FindNextFileA
FindClose
Sleep
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
vcruntime140
__C_specific_handler
strrchr
__current_exception
__current_exception_context
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
fread
__p__commode
ftell
__stdio_common_vsprintf
fwrite
rewind
fopen
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
fseek
fclose
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
__p___argc
_register_onexit_function
_crt_atexit
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_initialize_onexit_table
_exit
_set_app_type
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ