G:\CangLong\bin\Launch.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a56f581184732772f3c3d8446e43a137d6980efda2e1e516c2cd91c9127fc483.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a56f581184732772f3c3d8446e43a137d6980efda2e1e516c2cd91c9127fc483.exe
Resource
win10v2004-20240508-en
General
-
Target
a56f581184732772f3c3d8446e43a137d6980efda2e1e516c2cd91c9127fc483
-
Size
5.9MB
-
MD5
11b9785752f5a1f541c0925f24a8d123
-
SHA1
2d7fc4d0186de7d078070d3422bf57512237140b
-
SHA256
a56f581184732772f3c3d8446e43a137d6980efda2e1e516c2cd91c9127fc483
-
SHA512
0c32baf131be1e8d11d6d9bd4031af4114141cbf9990345bb343568b1ab0ba0317b4e70c8720db1aaf0af4d5cccd8c2c9ee366d055e9bd146e72d1d0a6d33822
-
SSDEEP
98304:v4sleplNP7BWVR/sbbKcOCIN5zB0MYcbvRxEs2zvmCVegj2Rd4RAme8J5xT:vH0uaROCasuLuzvmCVDcdcVf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a56f581184732772f3c3d8446e43a137d6980efda2e1e516c2cd91c9127fc483
Files
-
a56f581184732772f3c3d8446e43a137d6980efda2e1e516c2cd91c9127fc483.exe windows:6 windows x64 arch:x64
e31716f9947c4c5cd52d784a2a0fd3d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
wldap32
ord117
bcrypt
BCryptGenRandom
oleacc
CreateStdAccessibleObject
dbghelp
SymGetModuleBase64
dwrite
DWriteCreateFactory
d2d1
ord1
uiautomationcore
UiaRaiseAutomationEvent
oleaut32
SafeArrayGetElemsize
ole32
OleInitialize
uxtheme
IsThemeBackgroundPartiallyTransparent
shell32
ShellExecuteW
advapi32
CheckTokenMembership
winspool.drv
OpenPrinterW
gdi32
GetTextFaceW
user32
MessageBoxW
kernel32
LoadLibraryExA
dwmapi
DwmEnableBlurBehindWindow
comctl32
_TrackMouseEvent
imm32
ImmGetContext
msimg32
AlphaBlend
gdiplus
GdipSetPenDashStyle
shlwapi
PathFileExistsW
crypt32
CertCloseStore
winmm
timeSetEvent
ws2_32
listen
Sections
.text Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ