C:\Users\Andre\Documents\Visual Studio 2015\Projects\ghost\Release\zombie.pdb
Static task
static1
Behavioral task
behavioral1
Sample
zombie.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
zombie.exe
Resource
win11-20240611-en
General
-
Target
zombie.exe
-
Size
3.4MB
-
MD5
cd9afb1c49afc161959bdecd9fa7dec1
-
SHA1
edcb4a567dec7b848342ebc57b28deed5cf7acb5
-
SHA256
f3042ee1de43efe8c9e2a01b80c1cd71e96890461bd5ff7fec12f27399c0f69c
-
SHA512
0562c1afd43510f6cdc17d95512119a6038644da6e9b6d56663ff02bbc88249481e80341d122507eb6aaff31da376f6ffadc5878187fb8410408f151b3e189a6
-
SSDEEP
98304:V9bklvgA17Iwlxg4g/BPWOo4uVxYcVtoYpY/LQTlmHyxiS1xRNMEwJwkUwXNVPO:V9b2vgAlIwlxg4g/BPWOo4uVxYcLY/L2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zombie.exe
Files
-
zombie.exe.exe windows:6 windows x86 arch:x86
2f91e5394765d6d85d707f8b5a3d0c15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcp140
?_BADOFF@std@@3_JB
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Lockit_ctor@_Lockit@std@@SAXH@Z
??Bid@locale@std@@QAEIXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Lockit_dtor@_Lockit@std@@SAXH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?width@ios_base@std@@QAE_J_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xbad_function_call@std@@YAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?classic@locale@std@@SAABV12@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?precision@ios_base@std@@QAE_J_J@Z
?eof@ios_base@std@@QBE_NXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
kernel32
GetCurrentThreadId
Process32FirstW
CloseHandle
Process32NextW
LocalFree
Sleep
CreateThread
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateToolhelp32Snapshot
GetCurrentProcessId
QueryPerformanceCounter
GetSystemDirectoryA
GetTempPathA
GetModuleFileNameA
GetStartupInfoW
GetModuleHandleW
SetFileAttributesA
LockResource
LoadResource
SizeofResource
FindResourceA
WaitForSingleObject
CreateProcessA
GetVersionExA
GetComputerNameA
OpenProcess
api-ms-win-crt-stdio-l1-1-0
ungetc
fgetc
fclose
fwrite
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
_get_stream_buffer_pointers
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_crt_atexit
_seh_filter_dll
_initialize_narrow_environment
_register_onexit_function
abort
_crt_at_quick_exit
_invalid_parameter_noinfo
_errno
_cexit
terminate
exit
_initialize_onexit_table
_execute_onexit_table
api-ms-win-crt-string-l1-1-0
memset
vcruntime140
__FrameUnwindFilter
memmove
__CxxQueryExceptionSize
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__CxxDetectRethrow
_except_handler4_common
memchr
ole32
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
oleaut32
CreateErrorInfo
SetErrorInfo
VariantInit
VariantCopy
GetErrorInfo
VariantClear
VariantChangeType
SysFreeString
ws2_32
accept
listen
bind
setsockopt
connect
socket
getaddrinfo
WSAStartup
shutdown
freeaddrinfo
WSACleanup
closesocket
send
WSAGetLastError
recv
shell32
ShellExecuteA
advapi32
GetUserNameA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-math-l1-1-0
_dtest
_dsign
api-ms-win-crt-convert-l1-1-0
strtoul
strtod
api-ms-win-crt-filesystem-l1-1-0
remove
_unlock_file
_lock_file
mscoree
_CorExeMain
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 402KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ