C:\Projetos\daniel.jun\adiq\b\x86-32_windows_msvc9\release\sitadiq-sim.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17410d13a99a82705ae6cb4fbb8391d3b1e0f2130dbaee65fd430fb8dc5d2cdd.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
17410d13a99a82705ae6cb4fbb8391d3b1e0f2130dbaee65fd430fb8dc5d2cdd.exe
Resource
win10v2004-20240508-en
General
-
Target
17410d13a99a82705ae6cb4fbb8391d3b1e0f2130dbaee65fd430fb8dc5d2cdd
-
Size
1.5MB
-
MD5
0349767d54ddf27d1632e6807c02c401
-
SHA1
ae8d9f6ab47771280ddb2ebf398f433fd5135e65
-
SHA256
17410d13a99a82705ae6cb4fbb8391d3b1e0f2130dbaee65fd430fb8dc5d2cdd
-
SHA512
7de7cdc7f44f38ae292483afd4550e2adbff67bda7aa2428e1a54c3f40fdcaf3413129034a7aed568336f258443fc129ca89f15121ec55fa71eb9d9ac2c0c3fe
-
SSDEEP
24576:BnqLEopzH46VcTU5oo7LPupwTjzJ4sm7XusYi2OxmIfa:dqLzs7TyD3WhYG4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17410d13a99a82705ae6cb4fbb8391d3b1e0f2130dbaee65fd430fb8dc5d2cdd
Files
-
17410d13a99a82705ae6cb4fbb8391d3b1e0f2130dbaee65fd430fb8dc5d2cdd.exe windows:5 windows x86 arch:x86
5a7b6016061e8d83d3ddafe414bf04a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ncrypt
NCryptOpenStorageProvider
NCryptOpenKey
NCryptFreeObject
NCryptDecrypt
NCryptEncrypt
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
kernel32
CompareStringA
CompareStringW
DeleteCriticalSection
GetEnvironmentVariableA
CreateFileA
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
CloseHandle
ReadFile
WaitNamedPipeA
CreateNamedPipeA
CancelIo
ResetEvent
GetLastError
WaitForMultipleObjectsEx
ReadFileEx
GetOverlappedResult
SetMailslotInfo
GetMailslotInfo
CreateMailslotA
CreateEventA
WaitForSingleObject
CreateProcessA
GetStdHandle
SetHandleInformation
CreatePipe
FlushViewOfFile
InterlockedCompareExchange
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
WaitForSingleObjectEx
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
Sleep
SetFilePointer
SetEndOfFile
QueryPerformanceCounter
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
LoadLibraryA
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetVersionExA
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddress
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
AreFileApisANSI
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
SleepEx
InterlockedExchange
GetModuleHandleA
GlobalMemoryStatus
GetProcessTimes
GetCurrentProcess
GetThreadTimes
GetCurrentThread
QueryPerformanceFrequency
GetCurrentDirectoryA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindFirstFileA
FindClose
CreateDirectoryA
MoveFileExA
GetFileInformationByHandle
GetFileAttributesExA
SetFileAttributesA
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
DuplicateHandle
CopyFileA
InterlockedExchangeAdd
GetLocalTime
LoadLibraryExA
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
GetCommandLineA
WriteConsoleW
GetFileType
GetModuleFileNameW
GetTimeFormatA
GetDateFormatA
UnhandledExceptionFilter
SetConsoleCtrlHandler
ExitThread
CreateThread
SetEnvironmentVariableA
SetCurrentDirectoryA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
TerminateProcess
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
InterlockedIncrement
SetLastError
InterlockedDecrement
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
RtlUnwind
VirtualAlloc
WriteConsoleA
GetConsoleOutputCP
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 178KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ