D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\dotnet\dotnet.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6c657f2c21d39a46b3614caf7ea58bc0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6c657f2c21d39a46b3614caf7ea58bc0N.exe
Resource
win10v2004-20240709-en
General
-
Target
6c657f2c21d39a46b3614caf7ea58bc0N.exe
-
Size
701KB
-
MD5
6c657f2c21d39a46b3614caf7ea58bc0
-
SHA1
1e1ffa8737852dc7f915f90908ad153dc3abbc58
-
SHA256
470ec6b61e2a57ef4b7e9b3900cce3b099204bcd6e30a511f5e86bae1719f1f2
-
SHA512
92b365b216cd0b03a2ce9a830bba157c9e2fe90434f504955eb04517900105223fe0cf87456ed1e6c0495952ba320dcbe9658886c483cac8edba826964009878
-
SSDEEP
12288:dUFmDDAsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6ssqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c657f2c21d39a46b3614caf7ea58bc0N.exe
Files
-
6c657f2c21d39a46b3614caf7ea58bc0N.exe.exe windows:6 windows x64 arch:x64
92848c6e7798b7609b35d3e4b7daa3c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
GetEnvironmentVariableW
FindClose
FindFirstFileExW
GetFileAttributesExW
LoadLibraryA
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetLastError
OutputDebugStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SwitchToThread
GetCurrentThreadId
QueryPerformanceCounter
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
api-ms-win-crt-runtime-l1-1-0
__p___wargv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
abort
_errno
terminate
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_c_exit
api-ms-win-crt-stdio-l1-1-0
setvbuf
_wfsopen
__acrt_iob_func
fflush
fputwc
fputws
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__p__commode
api-ms-win-crt-string-l1-1-0
wcsncmp
strcpy_s
_wcsicmp
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
wcsftime
_time64
api-ms-win-crt-heap-l1-1-0
calloc
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE