D:\work\sinstar3.git\Release\FindCaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
496ff43282a5334e93bc335acc58e31db57d935e6773750b9ddbf9a617410879.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
496ff43282a5334e93bc335acc58e31db57d935e6773750b9ddbf9a617410879.exe
Resource
win10v2004-20240508-en
General
-
Target
496ff43282a5334e93bc335acc58e31db57d935e6773750b9ddbf9a617410879
-
Size
65KB
-
MD5
fe7d5aea8c28ba19feaafae59a1a2105
-
SHA1
1f6a1a2e393983503a89569233418b1a3fc9d133
-
SHA256
496ff43282a5334e93bc335acc58e31db57d935e6773750b9ddbf9a617410879
-
SHA512
a1ec714c77bfac94aad09ade9860f8dffbbd5318d8d18a7134daf99ea67facb367204107ec1b2035fdbce91f8f8e098c86ca83c116a8db60b70be58d726213b9
-
SSDEEP
768:olSxJVRwf9LuulFmM2vueEDSuM7+eScYtYwBXahRBtp6RhLY7l:oQdSlLNrZeHuC+eywRBHV5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 496ff43282a5334e93bc335acc58e31db57d935e6773750b9ddbf9a617410879
Files
-
496ff43282a5334e93bc335acc58e31db57d935e6773750b9ddbf9a617410879.exe windows:5 windows x86 arch:x86
3ad1a86970e4b589e3e92fafa442e065
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Process32FirstW
Module32FirstW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLastError
HeapFree
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
WideCharToMultiByte
user32
GetMessageW
PostQuitMessage
RegisterClassExW
LoadIconW
CreateWindowExW
SendMessageW
DefWindowProcW
DispatchMessageW
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ