C:\Users\User\Desktop\Tooling\Seatbelt-master\Seatbelt\obj\Release\Out\HocusPocus.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fb75f9820b51c008490f97958a8442a8814a9d6e07945875f4d9663237e1daa4.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fb75f9820b51c008490f97958a8442a8814a9d6e07945875f4d9663237e1daa4.exe
Resource
win10v2004-20240704-en
General
-
Target
fb75f9820b51c008490f97958a8442a8814a9d6e07945875f4d9663237e1daa4
-
Size
583KB
-
MD5
2241c1a9e232ef2aa57dc535123d441e
-
SHA1
ffa5c4df6ec359a8e721fb9fe2d8103aeabaa185
-
SHA256
fb75f9820b51c008490f97958a8442a8814a9d6e07945875f4d9663237e1daa4
-
SHA512
c3d13367d36c446f902b530b8b78bda72af2330b530d3646ef460c387c35645d9469361d4fa80e9cfeef9e6b15c2c1dd49a9266ed97fc79e871d4bb8ffbf77e0
-
SSDEEP
12288:mM/FMOqm3Z42QKDdYjtE6noQi00kh0Wb92Z:vJ4odYZE6noUlb92Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb75f9820b51c008490f97958a8442a8814a9d6e07945875f4d9663237e1daa4
Files
-
fb75f9820b51c008490f97958a8442a8814a9d6e07945875f4d9663237e1daa4.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 571KB - Virtual size: 570KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ