Static task
static1
Behavioral task
behavioral1
Sample
pet.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
pet.exe
Resource
win10v2004-20240709-en
General
-
Target
pet.exe
-
Size
3.6MB
-
MD5
bdec8f221ed6cbf52bee2c93b896401d
-
SHA1
926a9f904c1ad731fb6852eb1cebe5c32fc5fd8d
-
SHA256
fdbac10de5dcce5db4acf4512d4d8f22127f5633506dd4c7be8c12f63c259f60
-
SHA512
f14f99eabb42697670f79b69c6f20028be8e97c77319d3aff75938a9451630761ac4e4c9d628817a348f0094e166cb0f0f9ce503447197d7c00d94d457c56597
-
SSDEEP
49152:zMu2L++/80Esq78psKyWQuLQzhM6GIkoqnEvdO4QITpPTpOsmPSOCAOM0KnY3r2x:P2Lt88FQcQzhM63dO4DZG1OHKnY3r2x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pet.exe
Files
-
pet.exe.exe windows:6 windows x64 arch:x64
12e32e5c6a068edd66f8e85da7c82c0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
kernel32
GetSystemTimePreciseAsFileTime
CloseHandle
GetCommandLineW
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapReAlloc
GetStdHandle
GetConsoleMode
SetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetFileType
GetFileInformationByHandleEx
GetLastError
HeapFree
FindNextFileW
GetCurrentThread
SetFilePointerEx
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
GetModuleHandleA
GetProcAddress
SetLastError
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentDirectoryW
lstrlenW
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
FindClose
GetFileInformationByHandle
GetConsoleOutputCP
GetFullPathNameW
FindFirstFileW
WideCharToMultiByte
ReadConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
WaitForMultipleObjects
GetOverlappedResult
GetExitCodeProcess
CreateEventW
CancelIo
ReadFile
ExitProcess
HeapAlloc
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
GetFinalPathNameByHandleW
QueryPerformanceCounter
FlushFileBuffers
SetFileInformationByHandle
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
WriteFile
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExW
ntdll
RtlNtStatusToDosError
NtWriteFile
NtReadFile
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 899KB - Virtual size: 899KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ