C:\Users\yusakul\yusakul_file\project\cpp\blackdll\blackdll\Debug\CryptoGear_Encrypt.pdb
Behavioral task
behavioral1
Sample
778027c7eb9ebe52ee8c7931ac04618add3f1bde47e729df05204533c87d15dd.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
778027c7eb9ebe52ee8c7931ac04618add3f1bde47e729df05204533c87d15dd.exe
Resource
win10v2004-20240426-en
General
-
Target
778027c7eb9ebe52ee8c7931ac04618add3f1bde47e729df05204533c87d15dd
-
Size
45KB
-
MD5
6a682f0a2a35257be6a735d6135b816b
-
SHA1
b59c6fbca699c046054433e3874e0d4a12b173a4
-
SHA256
778027c7eb9ebe52ee8c7931ac04618add3f1bde47e729df05204533c87d15dd
-
SHA512
d0a94589a76e615c0ceee505c6282c8f86d504f289ae72ea424b3ba74f1f1919a3cd4c71ae72f3ecca53f53599c302091e4da6827a76857f78daf2418bd55c3b
-
SSDEEP
768:7DfdyCPogMRm6kibSUR2EJWheSqkDBk7:7D1yCPtMI6B2IcheNb
Malware Config
Extracted
metasploit
windows/download_exec
http://82.156.28.141:443/2jwI
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 778027c7eb9ebe52ee8c7931ac04618add3f1bde47e729df05204533c87d15dd
Files
-
778027c7eb9ebe52ee8c7931ac04618add3f1bde47e729df05204533c87d15dd.exe windows:6 windows x86 arch:x86
f28284983252443a3bd9dfd2ad8febf3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
vcruntime140d
__std_type_info_destroy_list
__current_exception_context
__current_exception
__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
memset
_except_handler4_common
memcpy
ucrtbased
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_fmode
_set_new_mode
__p__commode
_wmakepath_s
_wsplitpath_s
wcscpy_s
terminate
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_controlfp_s
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_seh_filter_exe
__stdio_common_vsprintf_s
strcat_s
strcpy_s
_CrtDbgReportW
_CrtDbgReport
fwrite
fopen
fclose
malloc
free
strlen
realloc
_configthreadlocale
kernel32
FreeLibrary
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetProcAddress
GetCurrentThreadId
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
IsProcessorFeaturePresent
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 306B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ