F:\share\iVentoy\VisualStudio\iVentoy\x64\Release\iVentoy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a10c51d56986f9bc5b7054f0bcc521f41f520fcea8851adf0c4b60b53a33380d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a10c51d56986f9bc5b7054f0bcc521f41f520fcea8851adf0c4b60b53a33380d.exe
Resource
win10v2004-20240611-en
General
-
Target
a10c51d56986f9bc5b7054f0bcc521f41f520fcea8851adf0c4b60b53a33380d
-
Size
1.1MB
-
MD5
0de08609f077a93ac21b8dc1bd33c670
-
SHA1
a0ebbddfae2b9b8f1b29381e15358d8098c2ccfe
-
SHA256
a10c51d56986f9bc5b7054f0bcc521f41f520fcea8851adf0c4b60b53a33380d
-
SHA512
20fc6d9294f7209063c9a34460b2a51f98672b820cad40915c91121c043c488a9ae006f594ccc26911a13c36c93432de0b7ad0140eac77e639206f19b8e27c9e
-
SSDEEP
24576:LLsHuEPiZcm3nBovf58FvLAbVekn89Dot3F:vsW858FjA51
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a10c51d56986f9bc5b7054f0bcc521f41f520fcea8851adf0c4b60b53a33380d
Files
-
a10c51d56986f9bc5b7054f0bcc521f41f520fcea8851adf0c4b60b53a33380d.exe windows:6 windows x64 arch:x64
cc108769b14f29014722e00924080f81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
iphlpapi
GetAdaptersInfo
ws2_32
WSASend
closesocket
WSAGetLastError
ioctlsocket
recv
send
connect
WSAGetOverlappedResult
getsockname
getsockopt
htonl
WSASetLastError
getpeername
select
WSAIoctl
WSARecv
WSAStartup
setsockopt
accept
listen
sendto
bind
socket
recvfrom
kernel32
HeapSize
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetEnvironmentVariableA
MultiByteToWideChar
GetSystemFirmwareTable
ReadFile
GetFileSizeEx
WriteFile
GetUserDefaultUILanguage
CreateFileW
GetLastError
CreateFileA
DeleteFileA
CloseHandle
GetSystemInfo
SetFilePointerEx
LoadLibraryExA
GetModuleFileNameW
CreateMutexA
GetFileAttributesW
SetDllDirectoryA
LoadLibraryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
WriteConsoleW
WaitForSingleObject
CreateEventA
GetCurrentThreadId
GetTickCount
UnmapViewOfFile
GetSystemDirectoryA
LocalAlloc
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
Sleep
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
CreateSemaphoreA
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetEndOfFile
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
HeapAlloc
LCMapStringW
CompareStringW
ResetEvent
GetTimeFormatW
GetDateFormatW
HeapFree
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
ReadConsoleW
GetConsoleMode
SetStdHandle
GetCommandLineW
GetCommandLineA
GetFileType
RaiseException
VirtualProtect
VirtualQuery
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetTimeZoneInformation
user32
EnableWindow
GetCursorPos
SetForegroundWindow
DialogBoxParamW
PostQuitMessage
AppendMenuW
GetDlgItem
LoadIconW
DestroyMenu
SetWindowTextA
ShowWindow
TrackPopupMenu
CreatePopupMenu
SetWindowTextW
EndDialog
MessageBoxW
SendMessageW
Sections
.text Size: 646KB - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ