C:\fapowure\yin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
Resource
win10v2004-20240709-en
General
-
Target
0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
-
Size
792KB
-
MD5
4e8dcbde14041ca343eea4ab3f0966c6
-
SHA1
ed696645eca467d84ea2fd5c7d03517f3762da93
-
SHA256
0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db
-
SHA512
fd31800fa8139f4cda7977b4bf4c298359e39d606f5db480063546765f9b4a1e3280abce985cb58fe8ae783479e0f006350e52e4bd6b8160a19ec2b3cb4f31bc
-
SSDEEP
24576:tocYLYjvFiJMEjiXyDxdY3l5bnZ/GZyN:2c5vsnjiXHbbZOwN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
Files
-
0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe.exe windows:5 windows x86 arch:x86
95ad07e52855bf052511ff6b3b1e2bcf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MoveFileExW
CreateDirectoryExA
FreeEnvironmentStringsA
GetConsoleAliasesLengthA
GetConsoleTitleA
ReadConsoleW
CreateDirectoryExW
LoadLibraryW
LeaveCriticalSection
WriteConsoleW
GetBinaryTypeA
GetMailslotInfo
lstrlenW
ReplaceFileA
GetConsoleAliasesW
GetStdHandle
GetLastError
SetConsoleTextAttribute
VirtualAlloc
MoveFileW
WriteProfileSectionA
LoadLibraryA
WriteConsoleA
GetProcessWorkingSetSize
SetCalendarInfoW
FindFirstChangeNotificationA
QueueUserWorkItem
VirtualProtect
GetCPInfoExA
InterlockedPushEntrySList
AllocConsole
GetProcAddress
SetFilePointer
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetFileType
DeleteCriticalSection
EnterCriticalSection
HeapCreate
VirtualFree
HeapFree
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
ReadFile
InitializeCriticalSectionAndSpinCount
SetStdHandle
RtlUnwind
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
HeapSize
CreateFileA
CloseHandle
user32
ClientToScreen
advapi32
ClearEventLogW
Sections
.text Size: 729KB - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�"��u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE