C:\kemuxide 20_vejucaxoci-98\polobehoyekow\wot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17162c71ce2d80958f522db0120136fb4dd06e3a6d39052bb2a582af82e2dac7.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
17162c71ce2d80958f522db0120136fb4dd06e3a6d39052bb2a582af82e2dac7.exe
Resource
win10v2004-20240709-en
General
-
Target
17162c71ce2d80958f522db0120136fb4dd06e3a6d39052bb2a582af82e2dac7.exe
-
Size
823KB
-
MD5
be87a7809c51f7fd3322ca3ed89a403e
-
SHA1
56bd690fa317066c0643d1224f384b92111a03bb
-
SHA256
17162c71ce2d80958f522db0120136fb4dd06e3a6d39052bb2a582af82e2dac7
-
SHA512
c45c4a5b69de0040d931354697b3b3c940c22d559f7460df56930d4b564917246597c33d82f8ede6e5f24114e2afc6061b77a163b0961954259c6340c2eec567
-
SSDEEP
12288:dgH8tsCSSJL8LklKIa+vacenxFTNXS+Mnj+SVgnGH+H6F0/eXRax78R:UoJIsFKnHExniSVgGHJF6F8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17162c71ce2d80958f522db0120136fb4dd06e3a6d39052bb2a582af82e2dac7.exe
Files
-
17162c71ce2d80958f522db0120136fb4dd06e3a6d39052bb2a582af82e2dac7.exe.exe windows:5 windows x86 arch:x86
4988f2ae63018c28daaeda2dba44eec2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetNamedPipeHandleStateW
FileTimeToSystemTime
EnumResourceTypesW
EnumResourceNamesW
FillConsoleOutputCharacterW
GetTimeZoneInformation
TerminateProcess
SetLastError
SetEvent
FindNextFileA
GetCompressedFileSizeW
CopyFileExW
BuildCommDCBAndTimeoutsA
QueryDepthSList
GetVersionExW
VerifyVersionInfoW
ReadConsoleOutputCharacterA
SetDefaultCommConfigW
VerLanguageNameA
EscapeCommFunction
WritePrivateProfileStructW
FreeEnvironmentStringsA
CreateTimerQueue
FindNextVolumeMountPointW
GetWriteWatch
WriteConsoleInputA
SetComputerNameExW
FindAtomA
GlobalDeleteAtom
SetThreadPriority
CallNamedPipeW
GetDriveTypeW
VirtualProtect
LoadLibraryW
LocalAlloc
InterlockedDecrement
FindFirstChangeNotificationA
VerifyVersionInfoA
CopyFileA
FormatMessageW
SetDllDirectoryW
GetModuleHandleW
WritePrivateProfileStringA
GetUserDefaultLangID
GlobalUnfix
GetStartupInfoW
GetSystemWow64DirectoryW
CopyFileW
GetLastError
DebugBreak
SetConsoleCursorInfo
SetCalendarInfoA
SetConsoleCursorPosition
ContinueDebugEvent
InterlockedExchangeAdd
GetACP
FindFirstVolumeW
CreateActCtxA
GetConsoleAliasA
OutputDebugStringW
EnumResourceTypesA
lstrlenA
WriteConsoleW
GetPrivateProfileSectionNamesA
GlobalWire
FreeEnvironmentStringsW
lstrcatA
EnumCalendarInfoA
SetThreadAffinityMask
LockFile
RaiseException
VerSetConditionMask
SetConsoleCP
GetSystemWindowsDirectoryA
GetProfileStringA
GetQueuedCompletionStatus
AllocConsole
GlobalGetAtomNameA
SetComputerNameA
GetConsoleAliasExesLengthW
WriteConsoleInputW
CreateMailslotW
SetCommState
MoveFileWithProgressA
GetSystemTimeAdjustment
_hread
_lopen
EnumSystemLocalesW
GetConsoleAliasExesLengthA
MoveFileA
ResetWriteWatch
GetSystemWindowsDirectoryW
EnumDateFormatsW
GetModuleHandleA
DeleteAtom
GetComputerNameW
GetConsoleAliasesLengthA
FindFirstVolumeA
CancelDeviceWakeupRequest
AreFileApisANSI
OpenWaitableTimerA
OpenFileMappingA
SetProcessAffinityMask
GetConsoleAliasesLengthW
SetProcessShutdownParameters
FindNextVolumeMountPointA
ReadConsoleW
WriteConsoleOutputCharacterA
GetNumberFormatW
GetConsoleAliasExesA
GetBinaryTypeA
GetCurrentActCtx
InitializeCriticalSection
WriteProfileSectionA
SetLocaleInfoA
GetPrivateProfileStringA
LoadLibraryA
DeleteFileA
HeapValidate
IsBadReadPtr
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
InterlockedIncrement
GetProcAddress
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CloseHandle
CreateFileA
gdi32
GetCharWidth32A
advapi32
ImpersonateSelf
winhttp
WinHttpWriteData
msimg32
AlphaBlend
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 588KB - Virtual size: 752KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
�� h�u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE