C:\Users\Clive\source\repos\x86_driver\Release\x86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
580ef11908322d49d35edef4b0dde97deb75a5ead2f2395c64a5935f982c0cb7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
580ef11908322d49d35edef4b0dde97deb75a5ead2f2395c64a5935f982c0cb7.exe
Resource
win10v2004-20240508-en
General
-
Target
580ef11908322d49d35edef4b0dde97deb75a5ead2f2395c64a5935f982c0cb7.exe
-
Size
702KB
-
MD5
95996d628e7f15ed7290902c879aa81b
-
SHA1
8541fcb40e7863cc460a057fad6995a9da65b95c
-
SHA256
580ef11908322d49d35edef4b0dde97deb75a5ead2f2395c64a5935f982c0cb7
-
SHA512
261ddcbadc7f050edd01c8faafd2e2eb2a171a3b042fb9734c05677acfdf3f5ecee702ea059c32aa7bf2f4f4871ac5b227cf18f690667eb74fb848876282d6ea
-
SSDEEP
12288:3SWRXlSxAT8vKxPl70hXuYV0CsDdflRgvpGuEPf9+NPn7NeVc1:BuxAT8vKxZYkRflAC8Nci
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 580ef11908322d49d35edef4b0dde97deb75a5ead2f2395c64a5935f982c0cb7.exe
Files
-
580ef11908322d49d35edef4b0dde97deb75a5ead2f2395c64a5935f982c0cb7.exe.exe windows:6 windows x86 arch:x86
28ad50542f813b012843ce887d0559ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathIsDirectoryA
PathFileExistsA
advapi32
RegSetValueExW
RegSetValueExA
OpenProcessToken
AdjustTokenPrivileges
RegFlushKey
RegCreateKeyExW
LookupPrivilegeValueA
user32
wsprintfA
SetWindowPos
IsWindowVisible
GetAsyncKeyState
MapVirtualKeyA
GetSystemMetrics
GetWindowRect
GetCursorPos
EnumWindows
GetWindow
GetWindowThreadProcessId
GetTopWindow
ntdll
RtlUnwind
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
NtLoadDriver
NtQuerySystemInformation
winhttp
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
kernel32
SetStdHandle
QueryDosDeviceA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
GetCurrentDirectoryW
DeleteFileW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
FindClose
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
CreateFileW
WriteFile
CloseHandle
GetCurrentDirectoryA
CreateDirectoryA
CreateFileA
GetFileSize
ReadFile
SetFilePointer
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
OpenProcess
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
lstrcmpiA
lstrcpyA
lstrcatA
lstrlenA
GetLogicalDriveStringsA
FindResourceA
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteConsoleW
CopyFileA
IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetProcessImageFileNameA
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
TlsGetValue
TlsAlloc
SetLastError
shell32
ShellExecuteA
wininet
HttpQueryInfoA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
Sections
.text Size: 402KB - Virtual size: 402KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 381.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ