E:\MyGit\mylibrary\PeMemoryRun\Debug\PeMemoryRun9.pdb
Static task
static1
Behavioral task
behavioral1
Sample
674a338a72aeb79df6b94fc847444df22fff800cfaa5cefd64a3aa58cae6c7cf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
674a338a72aeb79df6b94fc847444df22fff800cfaa5cefd64a3aa58cae6c7cf.exe
Resource
win10v2004-20240508-en
General
-
Target
674a338a72aeb79df6b94fc847444df22fff800cfaa5cefd64a3aa58cae6c7cf
-
Size
9.2MB
-
MD5
d8f37867de99e4975fcbe9b8fc0d9ba4
-
SHA1
7bf53547f01ee2b9250407bb64f5b090d24bc190
-
SHA256
674a338a72aeb79df6b94fc847444df22fff800cfaa5cefd64a3aa58cae6c7cf
-
SHA512
51e52d5176a16eea070311df322644d96cce04f69dd05c64328a307d6423957eea4c33f2010f962e3a35300a607c09cffd91e79da2fb45083c25ea05162b94e9
-
SSDEEP
196608:JYe4Ffq7631UhiCM5DKQ8KKls8yXFHlKqol0m7JTjhO3ewo+m4XiGPh:JYtNaUCsvcyX1lcl0shO3y+ms
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 674a338a72aeb79df6b94fc847444df22fff800cfaa5cefd64a3aa58cae6c7cf
Files
-
674a338a72aeb79df6b94fc847444df22fff800cfaa5cefd64a3aa58cae6c7cf.exe windows:5 windows x86 arch:x86
99f7cd8e1d401e1513cc4d7dd86e0b98
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
user32
FrameRect
gdi32
CreateRectRgnIndirect
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegEnumKeyExA
shell32
SHAppBarMessage
comctl32
InitCommonControlsEx
shlwapi
PathRemoveExtensionA
ole32
DoDragDrop
oleaut32
SysFreeString
oledlg
ord8
oleacc
LresultFromObject
gdiplus
GdipGetImageGraphicsContext
imm32
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 9.1MB - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE