C:\Users\DODO\Videos\TwoStageSearch\TwoStageSearch\TwoStageSearch\Release\TwoStageSearch.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fe29c2645c8816cd363f9541ea3f38597a8ebf9c29259890680405a5e706c1a7.exe
Resource
win7-20240508-en
General
-
Target
fe29c2645c8816cd363f9541ea3f38597a8ebf9c29259890680405a5e706c1a7
-
Size
667KB
-
MD5
5bd91a079abcd9b4bb4ecc3f48b1cce3
-
SHA1
f1a8da30f36b3e3fd980b9e5e4aee57e264b9452
-
SHA256
fe29c2645c8816cd363f9541ea3f38597a8ebf9c29259890680405a5e706c1a7
-
SHA512
57293850bd66bbcbdba2bde8bec9bbc86c114d08316196b25d3ef00cbf2ce82149c0313e7753464739316dca6d9da5134c9ce0ee1f5a1cf9940d79d3139a38ae
-
SSDEEP
12288:6+JJG//twCZ1CFy6jpcFnRO6QuiCDuBMoCKazA:6+J6/twC1N6jiVk6Quix4i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe29c2645c8816cd363f9541ea3f38597a8ebf9c29259890680405a5e706c1a7
Files
-
fe29c2645c8816cd363f9541ea3f38597a8ebf9c29259890680405a5e706c1a7.exe windows:6 windows x86 arch:x86
beb5959bb1e83e2e3f4789da7e63bdcd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
GetExitCodeProcess
ReadFile
CreateFileW
GetTempPathW
GetFileSizeEx
GetLastError
GetCurrentDirectoryW
GetProcAddress
VirtualAlloc
FindClose
SetCurrentDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
FlushFileBuffers
GetFullPathNameA
WriteConsoleW
CreateProcessW
WaitForSingleObject
ReadConsoleW
SetEndOfFile
GetTimeZoneInformation
SetStdHandle
RtlUnwind
HeapReAlloc
OutputDebugStringW
LoadLibraryExW
FreeLibrary
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LoadLibraryW
GetStringTypeW
SetEnvironmentVariableW
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
DeleteCriticalSection
RaiseException
GetFileAttributesExW
CreateSemaphoreW
GetTickCount
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFullPathNameW
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
HeapSize
GetModuleFileNameW
WriteFile
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetModuleHandleW
GetLocaleInfoW
FindFirstFileExW
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetCurrentThread
SetLastError
GetCPInfo
GetOEMCP
SetFilePointer
FindFirstFileW
CreateFileA
GetTempFileNameW
FatalAppExitA
GetACP
IsValidCodePage
GetCommandLineW
HeapFree
HeapAlloc
EncodePointer
DecodePointer
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
IsDebuggerPresent
IsProcessorFeaturePresent
SetEnvironmentVariableA
user32
EndPaint
ClientToScreen
DestroyWindow
GetWindowTextLengthW
TranslateAcceleratorW
ScreenToClient
GetWindowRect
SetActiveWindow
GetMessageW
SendInput
PostQuitMessage
SetKeyboardState
GetKeyState
GetSubMenu
GetFocus
DialogBoxParamW
GetParent
LoadCursorW
GetClipCursor
FindWindowW
GetClientRect
SetFocus
BeginPaint
wsprintfW
TranslateMessage
LoadAcceleratorsW
GetKeyboardState
GetMenu
RegisterClassExW
OffsetRect
GetAsyncKeyState
MessageBoxA
SetCursorPos
LoadMenuW
GetAncestor
GetWindowTextW
PeekMessageW
GetDlgItem
EndDialog
GetDesktopWindow
GetCursorPos
LoadStringW
EnumChildWindows
ShowWindow
SetMenu
GetSysColorBrush
LoadBitmapW
CreateDialogParamW
FindWindowExW
ClipCursor
CreateWindowExW
SetMenuDefaultItem
MessageBoxW
GetComboBoxInfo
GetSystemMetrics
IsWindowVisible
SendMessageW
UpdateWindow
GetDlgCtrlID
SetWindowTextW
DefWindowProcW
CopyRect
GetWindow
MoveWindow
DispatchMessageW
LoadIconW
gdi32
CreateFontW
DeleteObject
advapi32
CryptAcquireContextA
shell32
ShellExecuteW
SHOpenWithDialog
ShellExecuteExW
comctl32
ord413
ImageList_Add
ImageList_Create
ord410
shlwapi
ord191
PathMatchSpecW
Exports
Exports
T5676thdrgddhf
Sections
.text Size: 385KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ