C:\Users\JoeWin10\source\repos\PoseMod32\x64\64\PoseMod32.pdb
Static task
static1
1 signatures
General
-
Target
PoseMod64.exe
-
Size
183KB
-
MD5
a7bc1c675d2cb04ee6d76b5d36685ea7
-
SHA1
c1edcf625365ae80e3e611557cf27faf0dd4638d
-
SHA256
e8f7319bce558c94204cd921dbf77a241c05af07f6b00751f2b4b5add7759e38
-
SHA512
7a30c7d12d2793db6a245370869511994b25fcd50c225681ab629fe71515359426fa3d9ffee92977ac51b4ad51095eadf30ef405be4222e9b1918481e5d3d58e
-
SSDEEP
3072:N9rqNzJrJdpQ8ZhpSqlV+2dpURlmhcSKvc/56Fcgg+:Qzj3fpx+2LURlmhKBR
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PoseMod64.exe
Files
-
PoseMod64.exe.exe windows:6 windows x64 arch:x64
fe303a14e58adfb4b2db7e768f9c1122
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WriteProcessMemory
FindFirstFileExW
GetFullPathNameW
FindNextFileW
FindClose
GetModuleHandleA
OpenProcess
Sleep
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
CreateProcessA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
user32
MessageBoxA
vcruntime140
__current_exception
__C_specific_handler
memset
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fclose
__acrt_iob_func
fopen
fgetc
puts
__stdio_common_vsprintf
__stdio_common_vfprintf
__p__commode
_set_fmode
__stdio_common_vfscanf
fread
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-runtime-l1-1-0
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
__p___argc
_set_errno
_get_initial_narrow_environment
api-ms-win-crt-convert-l1-1-0
mbstowcs_s
strtol
wcstombs_s
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ