netsh.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0fa95076b2e38d32dc7ad8afb98b1131e92fdb02e096f45bc24319138f95bcfd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0fa95076b2e38d32dc7ad8afb98b1131e92fdb02e096f45bc24319138f95bcfd.exe
Resource
win10v2004-20240508-en
General
-
Target
0fa95076b2e38d32dc7ad8afb98b1131e92fdb02e096f45bc24319138f95bcfd
-
Size
92KB
-
MD5
bf05f8d5b70d1f88173ffaf6403ed747
-
SHA1
d102ee561291f72f13b6737eef9e5e4033efc8b1
-
SHA256
0fa95076b2e38d32dc7ad8afb98b1131e92fdb02e096f45bc24319138f95bcfd
-
SHA512
eec0ca8025ede7ad6d375da33c86f499d41e6ed9c57032c919dd5673351e3ed760cf0e5863e28637332ffb716b1f2e30229e49ec2f2abd2077ed6533743351cd
-
SSDEEP
1536:+u2DunwZ66NSiWrgpEkmz2ionBihSdghmLS7xG94C:/Yunwoiem+z2iIBqhmLSo94C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fa95076b2e38d32dc7ad8afb98b1131e92fdb02e096f45bc24319138f95bcfd
Files
-
0fa95076b2e38d32dc7ad8afb98b1131e92fdb02e096f45bc24319138f95bcfd.exe windows:5 windows x86 arch:x86
aae38da216fd60b3b7689e2a3c11d2a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcspbrk
_except_handler3
_wctime
printf
time
fflush
fgets
_wcsnicmp
wprintf
swprintf
_iob
_wfopen
fclose
iswctype
_wcslwr
wcstok
_wcsdup
wcscpy
wcslen
wcsncpy
wcscat
qsort
_wcsicmp
wcschr
_wcsupr
wcsrchr
free
wcscmp
advapi32
RegQueryValueExW
CloseEventLog
NotifyChangeEventLog
OpenEventLogW
ReadEventLogW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegConnectRegistryW
kernel32
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetFilePointer
WaitForMultipleObjectsEx
WideCharToMultiByte
GetConsoleOutputCP
MultiByteToWideChar
WriteFile
WaitForSingleObject
ResetEvent
CreateEventW
CreateConsoleScreenBuffer
SetConsoleScreenBufferSize
SetConsoleActiveScreenBuffer
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
SetConsoleCursorPosition
CreateFileW
FreeLibrary
GetProcAddress
LoadLibraryW
HeapReAlloc
GetComputerNameW
SetConsoleCtrlHandler
GetModuleHandleW
FormatMessageW
LocalFree
GetStdHandle
SetEvent
ExpandEnvironmentStringsW
CloseHandle
OpenEventW
mprapi
MprConfigGetFriendlyName
MprConfigBufferFree
MprConfigInterfaceEnum
MprConfigGetGuidName
MprAdminGetErrorString
MprConfigInterfaceGetHandle
ntdll
RtlInitUnicodeString
RtlGUIDFromString
ole32
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
oleaut32
SysFreeString
VariantChangeType
SysAllocString
rasapi32
RasGetErrorStringW
user32
LoadStringW
wsprintfW
iphlpapi
NhGetInterfaceNameFromGuid
Exports
Exports
ConvertGuidToString
ConvertStringToGuid
DisplayMessageM
DisplayMessageToConsole
FreeQuotedString
FreeString
GenericMonitor
GetEnumString
GetHostMachineInfo
InitializeConsole
MakeQuotedString
MakeString
MatchCmdLine
MatchEnumTag
MatchTagsInCmdLine
MatchToken
NsGetFriendlyNameFromIfName
NsGetIfNameFromFriendlyName
PreprocessCommand
PrintError
PrintEventLog
PrintMessage
PrintMessageFromModule
RefreshConsole
RegisterContext
RegisterHelper
Sections
.text Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 33KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA