D:\Dev\Tin9\InstallDir\vc80x86u\Loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
65ef9ec1b1e27779a1c13b65e8a7f403e24856d448adba98461c2ecb888b5aec.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65ef9ec1b1e27779a1c13b65e8a7f403e24856d448adba98461c2ecb888b5aec.exe
Resource
win10v2004-20240704-en
General
-
Target
65ef9ec1b1e27779a1c13b65e8a7f403e24856d448adba98461c2ecb888b5aec.exe
-
Size
2.9MB
-
MD5
5d54953c33a145ee7a52355aa57edbf2
-
SHA1
d2ed7ffb2f11ecaf84272ddcce3ed126aa737793
-
SHA256
65ef9ec1b1e27779a1c13b65e8a7f403e24856d448adba98461c2ecb888b5aec
-
SHA512
ed06843f9715227533ce1ff0a2dbbb32f6d0b4b5186d61b6cb76aa818c10ecdb466c1f556a2f824d4e03e7376ff00d94f9d8dfe46786708d7bb64342d784ca20
-
SSDEEP
49152:XzOFQEXBWlRuTBgG1q7W7yR6wAc/AKrPcUpu8C35cFzCkPJVIQbdAeQw:D4QPLgBHq7WWMYYKrP9I8CJUC2J+VeQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65ef9ec1b1e27779a1c13b65e8a7f403e24856d448adba98461c2ecb888b5aec.exe
Files
-
65ef9ec1b1e27779a1c13b65e8a7f403e24856d448adba98461c2ecb888b5aec.exe.exe windows:4 windows x86 arch:x86
20c4b14b5064e66d073d37066475b11c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
OutputDebugStringA
FreeLibrary
GetLastError
lstrcpynW
GetProcAddress
LoadLibraryExW
GetSystemDirectoryW
UnmapViewOfFile
MultiByteToWideChar
MapViewOfFile
CloseHandle
CreateFileMappingW
GetFileSize
CreateFileW
lstrlenW
GetCommandLineW
ExitProcess
Sleep
DeleteFileW
SetFileAttributesW
GetFileAttributesW
GetTempPathW
GetModuleHandleW
GetModuleFileNameW
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetVersionExW
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapFree
ReadFile
WriteFile
SetFileTime
SetFilePointer
user32
wvsprintfA
wsprintfW
PostMessageW
MessageBoxA
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.tsustub Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.tsuarch Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ