mt2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6610b6f0fcb7c6897dafb061384e6928a490c7d0dc06ac5d3bb0c2238916026c.exe
Resource
win10v2004-20240508-en
General
-
Target
6610b6f0fcb7c6897dafb061384e6928a490c7d0dc06ac5d3bb0c2238916026c
-
Size
1.9MB
-
MD5
6613be20a104f573d37d0bcb99880827
-
SHA1
456e24d108857fa61353174d4ce38b2fb3c328f3
-
SHA256
6610b6f0fcb7c6897dafb061384e6928a490c7d0dc06ac5d3bb0c2238916026c
-
SHA512
ad61ae3153a1f90bdee731fe1f83a2b37ba5277a6b3d77b09f2e5f2b0607bbf350692c760b42906a1dce1ca55577178117dd67e51cb436cf2cc9a88f366dfcb6
-
SSDEEP
49152:VOpO8ZojCyBvTi+08O+78zYEMQ5LkbgPecX6VqvOnrfPOkhqvq:M8O+7MYhQ5Lkb2AOkf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6610b6f0fcb7c6897dafb061384e6928a490c7d0dc06ac5d3bb0c2238916026c
Files
-
6610b6f0fcb7c6897dafb061384e6928a490c7d0dc06ac5d3bb0c2238916026c.exe windows:10 windows x86 arch:x86
0f6052a937d9d41ff8f9d7772a13248b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntdll
RtlDowncaseUnicodeChar
DbgPrintEx
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlUpcaseUnicodeChar
RtlHashUnicodeString
NtQueryPerformanceCounter
RtlFreeAnsiString
NtClose
RtlUnicodeStringToAnsiString
RtlNtStatusToDosErrorNoTeb
RtlUnwind
NtCreateFile
DbgPrint
NtWriteFile
bcrypt
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
kernel32
SetEnvironmentVariableW
GetLastError
FormatMessageW
GetModuleHandleW
CreateFileW
WriteFile
SetEndOfFile
CloseHandle
LocalFree
GetStdHandle
GetEnvironmentVariableW
SetStdHandle
GetFileType
GetConsoleMode
HeapSetInformation
GetCurrentDirectoryW
GetFileSize
ReadFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindNextFileW
LoadLibraryA
GetProcAddress
FindResourceExW
LoadResource
SizeofResource
LockResource
EnumResourceLanguagesExW
FindFirstFileExW
MultiByteToWideChar
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DuplicateHandle
GetCurrentProcess
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
HeapAlloc
HeapFree
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryExW
CreateFileA
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStartupInfoW
GetModuleFileNameW
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
OutputDebugStringW
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
WriteConsoleW
HeapSize
HeapReAlloc
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
MapViewOfFile
HeapDestroy
FindClose
SwitchToThread
EnumResourceNamesW
InitializeCriticalSection
GetModuleFileNameA
CreateFileMappingA
UnmapViewOfFile
GetFileAttributesW
DebugBreak
RaiseException
GetCommandLineA
LCMapStringEx
DecodePointer
InitOnceExecuteOnce
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetFullPathNameW
EnumResourceLanguagesW
lstrcmpiA
ole32
CLSIDFromString
CoInitialize
StringFromIID
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
advapi32
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
ConvertStringSecurityDescriptorToSecurityDescriptorW
shell32
CommandLineToArgvW
imagehlp
ImageDirectoryEntryToData
ImageRvaToVa
ImageGetDigestStream
ImageNtHeader
oleaut32
VariantInit
LoadTypeLibEx
SysStringLen
VariantChangeType
VariantClear
SysFreeString
VarBstrCat
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
user32
UnregisterClassA
CharNextA
CharNextW
midlrtmd
MetaDataGetDispenser
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 620KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE