D:\shoukeduanbak\updaterok\updateok\Release\updataok.pdb
Static task
static1
Behavioral task
behavioral1
Sample
775b64d697a238ecb4d8d9a196a82c936fc057e0e7f12745bd238b9fc0c22b77.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
775b64d697a238ecb4d8d9a196a82c936fc057e0e7f12745bd238b9fc0c22b77.exe
Resource
win10v2004-20240426-en
General
-
Target
775b64d697a238ecb4d8d9a196a82c936fc057e0e7f12745bd238b9fc0c22b77
-
Size
475KB
-
MD5
c748fe62992f3d714672c81de0dd94ae
-
SHA1
98e57a4a9ab8f56658a1677b63052c6af21f5934
-
SHA256
775b64d697a238ecb4d8d9a196a82c936fc057e0e7f12745bd238b9fc0c22b77
-
SHA512
354594852e603ac3bc851e060410686670a622e373ff528bd501cfdaecf1e54c23074a2e9d98c3f0c8b40596f1b15a1c81ee910f267a17ede499f69d9ae7b4e4
-
SSDEEP
12288:RZoMhhS5RDIJ0dYkAsBNUyQ/IvhcZCw1GggO:RZxJ0dYktUyQguZCw1GggO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 775b64d697a238ecb4d8d9a196a82c936fc057e0e7f12745bd238b9fc0c22b77
Files
-
775b64d697a238ecb4d8d9a196a82c936fc057e0e7f12745bd238b9fc0c22b77.exe windows:6 windows x86 arch:x86
4cbabfd3960d21f52205aa72bfd6af1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
Sleep
WaitForMultipleObjects
TerminateThread
GetLocalTime
lstrcpynA
GetModuleFileNameA
DeleteFileA
ReadFile
OutputDebugStringA
CreateFileW
GetConsoleOutputCP
WriteFile
SetFilePointer
SetEndOfFile
CreateFileA
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
WritePrivateProfileStringA
CreateDirectoryA
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleFileNameW
SetLastError
EncodePointer
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
HeapValidate
GetSystemInfo
ExitProcess
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetConsoleMode
ReadConsoleW
GetFileAttributesExW
GetFileSizeEx
SetFilePointerEx
OutputDebugStringW
HeapReAlloc
HeapSize
HeapQueryInformation
FindClose
FindFirstFileExW
DecodePointer
user32
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ws2_32
WSAStartup
gethostbyname
socket
send
WSACleanup
recv
htons
ioctlsocket
connect
closesocket
WSAGetLastError
select
iphlpapi
GetAdaptersInfo
Sections
.text Size: 324KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ