F:\third party\MemoryModulePP\haveEncode\Release\test.pdb
Static task
static1
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20240709-en
General
-
Target
test.exe
-
Size
233KB
-
MD5
a367354adbc212433004b84dd28bcee5
-
SHA1
655b9dcc6ceda8c52207184fd7729ba04e71ac9f
-
SHA256
de4cf63815f0f6ddc553ab323986d0be34da5521a390ce41b82599f40589b7ca
-
SHA512
a890490599d947c4b770b3f3dc2228945a39981c051ffad09f56298fcee0f2b208b967f9bc28dc4cebe273e95782f71c4dc78c89f3a2742da475347389449409
-
SSDEEP
6144:2O0+Xec/q/LWJ7a3fy26GmoE86sAwRHe+P3:2OjucSjWJ7aFmSe+P3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource test.exe
Files
-
test.exe.exe windows:6 windows x86 arch:x86
6682286c406bf3d8ac2287d31b4f3b99
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameA
VirtualFree
VirtualAlloc
GetProcAddress
SetEndOfFile
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetStdHandle
ReadFile
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
TerminateProcess
ExitProcess
DebugBreak
SetLastError
GetCurrentProcess
GetFileSizeEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
UnmapViewOfFile
CreateEventW
MultiByteToWideChar
GetFileInformationByHandle
GetFileAttributesExW
CloseHandle
LoadLibraryW
GetFileSize
GetModuleHandleW
GetSystemTimeAsFileTime
CreateFileMappingW
MapViewOfFile
MapViewOfFileEx
LoadLibraryA
GetSystemInfo
FreeLibrary
VirtualProtect
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
HeapFree
WaitForSingleObject
GetExitCodeThread
SetEvent
CreateThread
HeapAlloc
GetProcessHeap
OpenThread
LoadLibraryExW
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
WriteConsoleW
ntdll
NtQueryInformationThread
RtlInitializeBitMap
NtSetInformationProcess
LdrShutdownThread
RtlClearBits
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
NtQuerySystemInformation
RtlInitializeSRWLock
NtOpenThread
RtlReleasePebLock
NtMapViewOfSection
NtOpenSection
RtlFindClearBitsAndSet
NtClose
RtlAcquirePebLock
NtCreateSection
RtlGetNtVersionNumbers
RtlEncodeSystemPointer
RtlNtStatusToDosError
RtlRaiseStatus
NtQueryVirtualMemory
RtlImageDirectoryEntryToData
LdrUnlockLoaderLock
LdrLockLoaderLock
LdrUnloadDll
RtlHashUnicodeString
RtlUpcaseUnicodeChar
RtlAllocateHeap
NtQuerySystemTime
NtProtectVirtualMemory
RtlFreeHeap
RtlImageNtHeader
RtlExitUserThread
NtUnmapViewOfSection
Sections
.text Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ