extrac32.pdb
Behavioral task
behavioral1
Sample
1d8f5efafbf13e233914a09f1ee978f4.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1d8f5efafbf13e233914a09f1ee978f4.exe
Resource
win10v2004-20240611-en
General
-
Target
1d8f5efafbf13e233914a09f1ee978f4.bin
-
Size
196KB
-
MD5
1d8f5efafbf13e233914a09f1ee978f4
-
SHA1
0692500874b73abbdc1229c743dc9c5c0375eb88
-
SHA256
82b8b4fefadaf172ca9d86c2dece7900424eb62ee1f6fe843fa3e42773e1955b
-
SHA512
508df4b1a782aee65319c07c7800e3efe0679628ef5bc2ebbd783db13e3373251e69f528519851f4285624e1d078e37707451deaf1fbc99533d7d9dac15ff723
-
SSDEEP
6144:J+3ZH7QiebkLpOwRsQ6A0yUXEkgVQllv6rZVNp1:AHYkLpO4R0yUXE5KlvIVb1
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d8f5efafbf13e233914a09f1ee978f4.bin
Files
-
1d8f5efafbf13e233914a09f1ee978f4.bin.exe windows:6 windows x86 arch:x86
022e4404f58ca1a97deac8e1388d5e59
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcessId
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileAttributesExA
SetFileAttributesA
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
Sleep
CreateFileA
GetVersion
GetProcAddress
GetModuleHandleW
GetLastError
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetModuleFileNameA
GetDriveTypeA
UnhandledExceptionFilter
user32
CharNextExA
DispatchMessageA
PeekMessageA
SendDlgItemMessageA
EnableMenuItem
GetSystemMenu
CreateDialogParamA
DestroyWindow
MessageBoxA
msvcrt
_errno
_mkdir
_write
_read
_eof
_tempnam
strpbrk
strspn
memcpy
atoi
isdigit
_chmod
strchr
_lseek
_chsize
tolower
getenv
_filelength
_stricmp
fgets
_iob
strncmp
exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
__doserrno
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
memset
?terminate@@YAXXZ
_controlfp
_vsnprintf
malloc
_strdup
free
_open
printf
_close
_unlink
isalpha
_getdrive
toupper
_stat
_initterm
comctl32
ord17
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE