E:\uih\vl0xk\6h3o\6bm\mtaz1co\p\bekyl\z\p\6nzp5k\4z\v2o2nktd\32\ax07o\zpbvjv21\t.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c4deecf965eb90ae8fa582f09e3064ffa1f89427af62e71ce0886a01307078ca.bin.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c4deecf965eb90ae8fa582f09e3064ffa1f89427af62e71ce0886a01307078ca.bin.exe
Resource
win10v2004-20240704-en
General
-
Target
c4deecf965eb90ae8fa582f09e3064ffa1f89427af62e71ce0886a01307078ca.bin.sample
-
Size
159KB
-
MD5
52d4ee681316f87860dad6a44f2aa5bb
-
SHA1
49bd7ccc3dc81c36f06874f65284b19804cba3a3
-
SHA256
c4deecf965eb90ae8fa582f09e3064ffa1f89427af62e71ce0886a01307078ca
-
SHA512
c19b85591e329ab2703d58c98de6549d4f13abc8436c25c43761392f90a4063105caec079ea599bc952162e1fe833ecb387be38242a3005f417912c9a918de04
-
SSDEEP
3072:5msIqlUoynzdWjmb8uJGJWPwgFCxUHMgtxr9U6f8q00jIggzhbnqtPN/:5msXUzdWjtQPDzhtxhX8q0+obqtPN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c4deecf965eb90ae8fa582f09e3064ffa1f89427af62e71ce0886a01307078ca.bin.sample
Files
-
c4deecf965eb90ae8fa582f09e3064ffa1f89427af62e71ce0886a01307078ca.bin.sample.exe windows:5 windows x86 arch:x86
307e59085b6a253c8135e7e82e84ff0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateEventA
CloseHandle
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
Sleep
GetModuleFileNameA
InterlockedIncrement
WaitForSingleObject
LocalAlloc
InterlockedCompareExchange
LocalUnlock
SetFilePointer
lstrcpynA
HeapAlloc
LoadLibraryExW
GlobalAddAtomA
GetSystemDefaultLCID
GetModuleHandleW
GetProcessHeap
MulDiv
GetOEMCP
VirtualProtect
lstrcmpiA
lstrlenW
RtlUnwind
CreateThread
GetCurrentThreadId
WaitForMultipleObjects
SetEvent
GetCurrentProcess
WriteFile
LocalSize
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
CreateFileA
LoadLibraryA
WideCharToMultiByte
InterlockedDecrement
LocalFree
GetStartupInfoA
GetVersion
lstrlenA
MultiByteToWideChar
InterlockedExchange
FreeLibrary
RaiseException
user32
PostMessageA
SystemParametersInfoA
ReleaseCapture
InflateRect
IsDlgButtonChecked
SetWindowLongA
ScreenToClient
MapDialogRect
SetFocus
LoadIconA
GetSystemMetrics
AppendMenuA
wsprintfW
SetDlgItemTextA
FillRect
UpdateWindow
SetRectEmpty
DefWindowProcA
SetTimer
RemoveMenu
DispatchMessageA
LoadMenuA
PostQuitMessage
GetMenu
TranslateMessage
GetSubMenu
KillTimer
WaitMessage
GetCursorPos
MessageBoxA
OffsetRect
GetCapture
CheckMenuItem
ShowCursor
SetRect
SendMessageA
EnableWindow
GetDoubleClickTime
gdi32
CreateCompatibleDC
GetObjectA
StretchBlt
SetStretchBltMode
CreateFontA
GetTextExtentPoint32A
GetDeviceCaps
Pie
CreatePen
BitBlt
DPtoLP
CreateSolidBrush
advapi32
RegOpenKeyExA
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegEnumValueA
RegQueryValueExA
RegNotifyChangeKeyValue
RegCloseKey
ole32
CoUninitialize
StgOpenStorage
GetRunningObjectTable
CoGetInterfaceAndReleaseStream
CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoInitialize
CreateBindCtx
StringFromGUID2
msvcrt
__dllonexit
atoi
_gmtime64
?terminate@@YAXXZ
strstr
_exit
printf
_stricmp
__CxxFrameHandler
??_U@YAPAXI@Z
__p__fmode
__set_app_type
_purecall
_setmbcp
exit
_amsg_exit
_vsnwprintf
__setusermatherr
_initterm
_controlfp
_vsnprintf
memcpy
??1type_info@@UAE@XZ
_unlock
_CxxThrowException
_acmdln
_strnicmp
__p__commode
_onexit
memset
towupper
_XcptFilter
??_V@YAXPAX@Z
_itoa
rand
_ismbblead
__getmainargs
_ltow
_cexit
swscanf
qsort
_lock
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.BSS1 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ