C:\Users\sabri\documents\visual studio 2010\Projects\cripto\Debug\Stub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe
Resource
win10v2004-20240426-en
General
-
Target
dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.zip
-
Size
1.0MB
-
MD5
c509c1ba7d5250ccfdf39149766fb2cd
-
SHA1
03cff5ce5f9bec9fca6ad5a708ed1fb3430883e9
-
SHA256
aa272f7bf389675ef6724679d4587f0213e7bf296c718e083ed9ad99d7c32395
-
SHA512
de44af93f4a78e55ccb590e9af8a24dfd2c5785b09e01ac2691ba6f66849d8485808d4756e19d5cf209f8213be58cfe06c2b2984161592bbcc105a5adcb36dde
-
SSDEEP
24576:KyYIx0juPn4DegVcNq1vKJlx2mUVte/FM2hk/VBPre/FRdc7UD9XZ:KrIO6P4ZgXKmIeNl+VBC97DP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec
Files
-
dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.zip.zip
Password: threatbook
-
dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe windows:5 windows x86 arch:x86
Password: threatbook
ef7682627060f23ffa810ecdaa9d6248
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ReleaseSemaphore
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetDriveTypeA
GetLogicalDriveStringsA
GetConsoleWindow
SetEvent
CreateEventA
WaitForSingleObjectEx
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
WaitForMultipleObjectsEx
GetModuleHandleA
GetTickCount
HeapAlloc
GetLastError
SetLastError
QueryPerformanceCounter
CreateSemaphoreA
GetThreadTimes
GetCurrentThread
GetDateFormatA
GetTimeFormatA
CreateFileA
SetStdHandle
MoveFileA
OpenProcess
TerminateProcess
Sleep
LoadLibraryA
GetProcAddress
GetComputerNameA
GetFileAttributesA
SetFileAttributesA
CompareStringW
VirtualQuery
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapDestroy
HeapCreate
HeapQueryInformation
HeapSize
HeapReAlloc
GetModuleFileNameA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
OutputDebugStringW
CreateToolhelp32Snapshot
CloseHandle
Process32First
QueryPerformanceFrequency
Process32Next
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
InterlockedCompareExchange
RemoveDirectoryW
DeleteFileW
CreateFileW
DeviceIoControl
GetFileAttributesW
SetEndOfFile
SetFilePointerEx
CreateDirectoryExW
CopyFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
GetFileTime
SetFileTime
SetFileAttributesW
MoveFileExW
GetDiskFreeSpaceExW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
AreFileApisANSI
FormatMessageA
LocalFree
InterlockedExchangeAdd
TlsAlloc
TlsFree
TlsSetValue
GetCurrentProcessId
ResetEvent
OpenEventA
TlsGetValue
ResumeThread
GetSystemInfo
GetLogicalProcessorInformation
SystemTimeToFileTime
CreateWaitableTimerA
SetWaitableTimer
GetCurrentThreadId
RtlUnwind
GetModuleHandleW
ExitProcess
RaiseException
GetModuleFileNameW
WriteConsoleW
GetFileType
GetStdHandle
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapValidate
IsBadReadPtr
GetCommandLineA
HeapSetInformation
LoadLibraryW
LCMapStringW
GetCPInfo
CreateThread
ExitThread
InitializeCriticalSectionAndSpinCount
FatalAppExitA
IsProcessorFeaturePresent
WriteFile
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
FreeLibrary
GetLocaleInfoW
SetEnvironmentVariableW
SetEnvironmentVariableA
ReadFile
SetHandleCount
GetStartupInfoW
SetFilePointer
GetStringTypeW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
OutputDebugStringA
GetTimeZoneInformation
user32
SystemParametersInfoA
wsprintfA
ShowWindow
advapi32
CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
CryptGenRandom
RegCloseKey
CryptAcquireContextA
RegCreateKeyExA
shell32
SHGetFolderPathA
wininet
InternetConnectA
InternetCloseHandle
FtpSetCurrentDirectoryA
InternetOpenA
HttpSendRequestA
FtpPutFileA
HttpOpenRequestA
urlmon
ObtainUserAgentString
shlwapi
SHGetValueA
crypt32
CryptStringToBinaryA
CryptUnprotectData
iphlpapi
GetAdaptersInfo
Sections
.textbss Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 558KB - Virtual size: 557KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 85KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 514B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 806B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ